--- title: "Pentest Pricing: Fixed-Price Penetration Tests | Mr Cyber" url: https://mr-cyber.com/pricing language: en description: "Transparent fixed prices for penetration tests from €1,900. Binding price in the quote form, retest included." --- # Fixed prices for penetration tests You know what the test costs before we start. The price in the quote is the price on the invoice, and the retest is always included. [See my fixed price](https://mr-cyber.com/quote) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) - All prices fixed ## Prices at a glance Every test in this table is a manual pentest. Founding clients · until 31 Dec 2026 +1 test day free, worth about €950 Same fixed price, more coverage. First 5 fixed-price projects · 4 of 5 still available | Service | Test days included | Fixed price | See my fixed price | | --- | --- | --- | --- | | [Web application pentest](https://mr-cyber.com/services/web-application-penetration-testing) | 3 test days | from €2,900 | [See my fixed price](https://mr-cyber.com/quote?service=web) | | [API pentest](https://mr-cyber.com/services/api-penetration-testing) | 3 test days | from €2,400 | [See my fixed price](https://mr-cyber.com/quote?service=api) | | [iOS app pentest](https://mr-cyber.com/services/ios-app-penetration-testing) | 3 test days | from €2,900 | [See my fixed price](https://mr-cyber.com/quote?service=ios) | | [Android app pentest](https://mr-cyber.com/services/android-app-penetration-testing) | 3 test days | from €2,900 | [See my fixed price](https://mr-cyber.com/quote?service=android) | | [Desktop app pentest](https://mr-cyber.com/services/desktop-application-penetration-testing) | 4 test days | from €3,800 | [See my fixed price](https://mr-cyber.com/quote?service=desktop) | | [AI & LLM pentest](https://mr-cyber.com/services/ai-llm-penetration-testing) | 3 test days | from €2,900 | [See my fixed price](https://mr-cyber.com/quote?service=ai) | | [IoT & hardware pentest](https://mr-cyber.com/services/iot-hardware-penetration-testing) | 5 test days | from €4,700 | [See my fixed price](https://mr-cyber.com/quote?service=iot) | | [Cloud pentest](https://mr-cyber.com/services/cloud-penetration-testing) | 4 test days | from €3,300 | [See my fixed price](https://mr-cyber.com/quote?service=cloud) | | [External network pentest](https://mr-cyber.com/services/external-network-penetration-testing) | 2 test days | from €1,900 | [See my fixed price](https://mr-cyber.com/quote?service=external) | | [Internal network pentest](https://mr-cyber.com/services/internal-network-penetration-testing) | 4 test days | from €3,800 | [See my fixed price](https://mr-cyber.com/quote?service=internal) | | [Active Directory pentest](https://mr-cyber.com/services/active-directory-penetration-testing) | 4 test days | from €3,400 | [See my fixed price](https://mr-cyber.com/quote?service=ad) | | [Red teaming & assumed breach](https://mr-cyber.com/services/red-teaming) | 10 test days | from €9,500 | [See my fixed price](https://mr-cyber.com/quote?service=redteam) | | [Secure code review](https://mr-cyber.com/services/secure-code-review) | 3 test days | from €2,900 | [See my fixed price](https://mr-cyber.com/quote?service=code) | | iOS + Android together The shared backend is tested once. | 5 test days | from €4,800 | [See my fixed price](https://mr-cyber.com/quote?service=ios) | What changes the price: size of the app, number of roles, endpoints or hosts. Always included: retest within 60 days · debrief call · report in 5 business days · ticket import file · attestation letter Services exclusively for businesses. ## Continuous pentesting. One manual test day every month. For teams that want, for example, their web app tested by hand every month, all year round. Unlike the monthly AI-assisted pentest (an AI-assisted run every 2 weeks), here a tester tests by hand every month. €590 per month 1 manual test day per month - 1 manual test day per month, used for your releases - Save unused days within a calendar quarter for a big release - Every release tested before or right after go-live - Free retest of every fix - Questions answered between releases - Findings tracked in one running report - Monthly check of your external attack surface No minimum term, cancel monthly. 10% off when you pay a year upfront: €6,372 per year. Unused test days carry over within the calendar quarter and expire at its end. Services exclusively for businesses. ## AI-assisted pentest. A separate option, one-time or monthly. AI agents run the test, a senior tester steers it and verifies every finding. An option you choose specifically; it complements a manual pentest rather than replacing it. Prices per target. | Option | Price per target | | --- | --- | | One-time AI-assisted pentestEvery finding verified by the tester · a report within 5 business days · one free re-check of your fixes within 30 days | €590 one-time | | Monthly AI-assisted pentestA full run every 2 weeks · every finding verified by the tester · a short report after each run, all findings kept in one running list · fixes re-checked in the next run or on request | €390 per month | 1 target = 1 web app, 1 API with up to 50 endpoints, 1 external range with up to 16 IP addresses, or 1 cloud account (1 AWS account, 1 Azure subscription or 1 Google Cloud project). Monthly: no minimum term, cancel monthly. 10% off when you pay a year upfront (€4,212 per target per year). More targets: price × number of targets. Services exclusively for businesses. ## Included at no surcharge No extra fee for the topic itself. If it needs more test days, the quote shows them upfront. - [Microsoft 365, Part of: Cloud pentest](https://mr-cyber.com/services/cloud-penetration-testing#m365) - [Kubernetes, Part of: Cloud pentest](https://mr-cyber.com/services/cloud-penetration-testing#kubernetes) - [CI/CD, Part of: Secure code review](https://mr-cyber.com/services/secure-code-review#cicd) - [Hardening review, Part of: Internal network pentest](https://mr-cyber.com/services/internal-network-penetration-testing#hardening) - [Wireless, Part of: Internal network pentest](https://mr-cyber.com/services/internal-network-penetration-testing#wireless) - [Phishing, Part of: Red teaming & assumed breach](https://mr-cyber.com/services/red-teaming#phishing) - [OSINT, Part of: External network pentest](https://mr-cyber.com/services/external-network-penetration-testing#osint) - [Hardware & firmware, Part of: IoT & hardware pentest](https://mr-cyber.com/services/iot-hardware-penetration-testing#hardware) ## Engagement models. When a single test is not the right fit. - Not a pentest ### Vulnerability assessment A lighter, scan-based check with manual verification. Not a pentest, and we tell you when you need one. - Scan of up to 32 agreed IP addresses for known vulnerabilities - Manual check of relevant results, false positives removed - Short report with priorities and fixes - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 - Free re-scan of fixed findings from €390 · up to 32 IP addresses - ### Assumed breach Starts on a prepared workstation and shows how far an attacker gets, and what your team detects. - One agreed scenario with written rules of engagement - Objective-based testing from inside your network - One purple-team session with your defenders - Report with attack path and detection results from €5,700 · 6 test days - ### OT & ICS security assessment Production networks and control systems, assessed passive-first and in agreed windows to keep the impact on operations minimal. - Passive review of documents and network traffic - Active checks only on systems and in windows you release - On-site work in DACH with your OT staff - Report with IEC 62443 references from €5,700 · 6 test days · plus travel - ### Smart contract audit Manual security review of your Solidity contracts before or after deployment. - Line-by-line review of one agreed commit - Access control, funds handling, upgrades and external calls - Report naming the reviewed commit - Review of your fixes from €4,700 · 5 test days - ### Automotive security testing ECUs, telematics and infotainment, with evidence for ISO/SAE 21434 and your OEM. Quoted per project. - Scope based on your TARA or component interfaces - Bench tests, vehicle tests by arrangement - Report structured for your ISO/SAE 21434 work products Price on request Services exclusively for businesses. ## Get a binding fixed price in under a minute In the quote form you answer up to three plain questions per service and see your binding fixed price and test days at once, valid for 30 days. ## FAQ Why fixed prices instead of day rates? With a fixed price we carry the risk if testing takes longer, not you. You can budget with certainty. What does a penetration test typically cost? Depending on scope, typical projects range from €1,900 to a mid five-figure amount. The quote form gives you a binding fixed price for your scope in under a minute. Is the retest really free? Yes. We retest fixed findings within 60 days of report delivery at no extra cost. Are there discounts for multiple tests? Each test has its own fixed price; pick several and the calculator adds them up to one total. Monthly services cost 10% less when you pay a year upfront.