---
title: "Penetration Test Cost in Germany (2026) | Mr Cyber"
url: https://mr-cyber.com/blog/penetration-test-cost-germany
language: en
description: "What drives the cost of a penetration test, fixed price vs. day rates, what must be included, and how to get the most security for your budget."
---

-   [Guides](https://mr-cyber.com/blog/tags/guides)
-   [Pricing](https://mr-cyber.com/blog/tags/pricing)

# What does a penetration test cost in Germany in 2026?

The cost of a penetration test depends mainly on scope (the number of functions, roles, hosts or users to test) and on the depth required. Fixed prices make the cost predictable. This guide explains the cost drivers, what a fair quote must include, and how to spend a limited budget where the risk is highest.

By [Moez Bouzayani](https://mr-cyber.com/about) · 17 October 2026 · 2 min read

“What does a pentest cost?” is usually the first question, and the honest answer is: **it depends on what you need tested**. But the factors that drive the price are predictable, and once you know them you can compare quotes properly.

## The main cost drivers

### 1\. Scope

The single biggest factor. Typical units are:

-   **Web applications:** number of pages/functions and user roles,
-   **APIs:** number of endpoints or operations,
-   **Mobile apps:** platforms (Android, iOS) and whether the backend is included,
-   **External network:** number of public IP addresses and services,
-   **Internal network / Active Directory:** number of users, sites and domains,
-   **Cloud:** number of accounts or subscriptions.

### 2\. Roles and tenants

Every user role (and in SaaS every tenant boundary) must be tested against every other. Three roles in a multi-tenant app mean many more test cases than one role in a single-tenant app.

### 3\. Test depth: black-, grey- or white-box

A **grey-box** test with test accounts and some documentation usually finds the most per euro. Black-box sounds more realistic but spends much of the budget on getting in rather than on testing what lies behind the login.

### 4\. Constraints

Out-of-hours testing, production-only environments, strict change windows or on-site requirements add effort.

## Fixed price vs. day rates

Many providers quote person-days. That’s transparent about effort, but you carry the risk if testing takes longer. A **fixed price** moves that risk to the provider: you know the cost before the test starts and can budget with certainty. Either way, ask how many testing days are planned: it tells you how deep the test will go.

## What a fair quote must include

Compare quotes only if they include the same things:

-   manual testing by an experienced tester (not just an automated scan),
-   an executive summary plus detailed findings with evidence and remediation,
-   severity scoring (e.g. CVSS 3.1) and prioritisation,
-   immediate notification of critical findings,
-   a debrief call,
-   **a retest** of fixed findings, often charged separately elsewhere.

A quote far below the market often means “scanner output with a logo”. A useful test can still be affordable if the scope is focused.

## How to get the most from a limited budget

1.  **Prioritise by risk.** Test what is internet-facing and what holds sensitive data first.
2.  **Provide test accounts and documentation.** Every hour not spent on discovery goes into finding vulnerabilities.
3.  **Combine related targets.** Test a web app and its API in one project: one kickoff, one report and one retest, and the test also covers how the two interact.
4.  **Plan a cycle.** An annual test plus retests is cheaper (and better evidence) than an irregular big-bang project.

## Get a concrete number

Our fixed prices are on the [pricing page](https://mr-cyber.com/pricing). For a binding price for your scope, a few clicks in the [quote form](https://mr-cyber.com/quote) are enough: you see your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.

## FAQ

How much does a web application pentest cost?

At Mr Cyber, fixed prices start at €2,900 for a smaller application with one or two roles. Larger applications cost more; our price calculator shows a binding fixed price and the test days in under a minute.

What is the cheapest useful pentest?

For many companies an external perimeter test is the best first step. The quote form shows its fixed price at once.

Is the retest included?

With us, yes. A retest of fixed findings within 60 days is always included. Ask any provider explicitly, because many charge extra.