How much does a penetration test cost?

The short answer: at Resync you pay a fixed price based on scope. You know exactly what you get and what it costs before the work begins, wherever you are based. Prices are set in euros and can be billed in EUR, USD or GBP. No hourly billing, no surprise invoices. An initial estimate is typically available within one business day after a short intake call.

Why no hourly rate

An hourly pentest may seem flexible, but it is an illusion. You don't know in advance how many hours you'll consume, and you pay for work that may not strictly belong to your application. Worse, it creates a perverse incentive: the tester earns more the longer they take, not the faster or more thoroughly they work.

With a fixed price, the scope is fixed. Whatever falls within it is tested — thoroughly, without watching the clock. If the test runs long for any reason, the price stays the same. If it finishes faster, the price stays the same. You're buying a result, not hours.

Which factors determine the price

• Number of endpoints and subsystems. An MVP with five endpoints is faster to test than a platform with hundreds.
• Type of test. Web application, API, mobile app, infrastructure — each requires a different approach.
• Number of roles. Each role is a separate authorisation tree that must be tested independently.
• Complexity of authentication and authorisation flows. SSO with multiple identity providers requires more than a username/password flow.
• Compliance context. NIS2, NEN 7510, ISO 27001 or SOC 2 determine which additional requirements apply to the reporting. Testing for an audit? See SOC 2 or ISO 27001.

The decisive factor is not hours — it's what needs to be tested.

The three scope categories

We broadly work with three scope categories. They give direction for your planning and budget; the exact price follows after the intake.

At Resync, cheaper means shorter, not worse

A thorough manual pentest of an application with multiple roles usually takes four to five testing days. That comes to around €5,000 to €6,000, in line with what serious providers charge. I offer that test too, and for many organisations it's the right choice.

Not everyone has that budget. When that's the case, I don't lower the quality, I lower the testing time: a Compact pentest from €2,500, or a one-day Security Quick Scan for €1,000. Every testing day is the same work: manual, by me, with the same report format, a digitally signed report and a retest. What changes is coverage. In a shorter test I focus on what carries the most risk: login and sessions, authorisation between users and roles, and the features that handle sensitive data or payments. The report states exactly what was and wasn't tested.

What I advise against: paying a pentester to run a scanner. Automated scanners such as OWASP ZAP are free and you can run them yourself. My time is worth most on what a scanner can't find: logic flaws, broken authorisation and chains of small weaknesses.

So the risk isn't a low price. It's scanner output sold as a pentest. Ask any provider: how many days of hands-on testing are included, and who does that work?

What you get before paying anything

• A no-obligation intake call (free, no commitments)
• A written scope definition and objectives
• A fixed-price quote detailing exactly what is included
• A schedule through to the retest

Only when you approve the quote and schedule does the project begin. Until then, it costs you nothing but a 30-minute intake call.

How do I request a quote?

The fastest route is a short intake. Send via the contact form what you want tested and any deadline you have in mind. You'll typically hear back within one business day. For a full explanation of the process, see the penetration testing page.