What does a penetration test cost in Germany in 2026?
The cost of a penetration test depends mainly on scope (the number of functions, roles, hosts or users to test) and on the depth required. Fixed prices make the cost predictable. This guide explains the cost drivers, what a fair quote must include, and how to spend a limited budget where the risk is highest.
By Moez Bouzayani · · 2 min read
Contents
“What does a pentest cost?” is usually the first question, and the honest answer is: it depends on what you need tested. But the factors that drive the price are predictable, and once you know them you can compare quotes properly.
The main cost drivers
1. Scope
The single biggest factor. Typical units are:
- Web applications: number of pages/functions and user roles,
- APIs: number of endpoints or operations,
- Mobile apps: platforms (Android, iOS) and whether the backend is included,
- External network: number of public IP addresses and services,
- Internal network / Active Directory: number of users, sites and domains,
- Cloud: number of accounts or subscriptions.
2. Roles and tenants
Every user role (and in SaaS every tenant boundary) must be tested against every other. Three roles in a multi-tenant app mean many more test cases than one role in a single-tenant app.
3. Test depth: black-, grey- or white-box
A grey-box test with test accounts and some documentation usually finds the most per euro. Black-box sounds more realistic but spends much of the budget on getting in rather than on testing what lies behind the login.
4. Constraints
Out-of-hours testing, production-only environments, strict change windows or on-site requirements add effort.
Fixed price vs. day rates
Many providers quote person-days. That’s transparent about effort, but you carry the risk if testing takes longer. A fixed price moves that risk to the provider: you know the cost before the test starts and can budget with certainty. Either way, ask how many testing days are planned: it tells you how deep the test will go.
What a fair quote must include
Compare quotes only if they include the same things:
- manual testing by an experienced tester (not just an automated scan),
- an executive summary plus detailed findings with evidence and remediation,
- severity scoring (e.g. CVSS 3.1) and prioritisation,
- immediate notification of critical findings,
- a debrief call,
- a retest of fixed findings, often charged separately elsewhere.
A quote far below the market often means “scanner output with a logo”. A useful test can still be affordable if the scope is focused.
How to get the most from a limited budget
- Prioritise by risk. Test what is internet-facing and what holds sensitive data first.
- Provide test accounts and documentation. Every hour not spent on discovery goes into finding vulnerabilities.
- Combine related targets. Test a web app and its API in one project: one kickoff, one report and one retest, and the test also covers how the two interact.
- Plan a cycle. An annual test plus retests is cheaper (and better evidence) than an irregular big-bang project.
Get a concrete number
Our fixed prices are on the pricing page. For a binding price for your scope, a few clicks in the quote form are enough: you see your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.