Size
Number of roles, features, endpoints, interfaces or systems. More surface means more days.
Pentest pricing
What a penetration test costs, in real numbers.
Most providers hide prices behind a contact form. Here are the ranges you can expect, what moves the price up or down, and why our self-hosted AI gives you more coverage for the same budget.
- Fixed price after scoping
- No surprise invoices
- Retest included
In short
A penetration test typically costs between €3,000 and €45,000, depending on the type and size of the target. A web application pentest usually costs €6,000 to €15,000, a mobile app €5,000 to €12,000, a cloud assessment €6,000 to €12,000, and a complete IoT product test €15,000 to €30,000. Prices follow the testing days needed; day rates in Germany are typically €1,200 to €1,800. Zyberum agrees a fixed price after a 15-minute scoping call.
Typical prices
Price ranges by test type
Market ranges for a professional, manual penetration test. Your fixed price depends on the scope.
| Test | Typical scope | Testing time | Typical price |
|---|---|---|---|
| Web application | One application, 2 to 4 roles, including its API | 5 to 10 days | €6,000 to €15,000 |
| API | One REST or GraphQL API, 20 to 60 endpoints | 3 to 6 days | €4,000 to €9,000 |
| Mobile app | One app per platform, including backend API | 4 to 8 days | €5,000 to €12,000 |
| External infrastructure | Internet-facing systems of one company | 2 to 5 days | €3,000 to €7,500 |
| Internal network & Active Directory | One site or domain, assumed breach | 5 to 12 days | €7,500 to €18,000 |
| Cloud | AWS, Azure or Microsoft 365 tenant | 4 to 8 days | €6,000 to €12,000 |
| Hardware & embedded | One device: interfaces, firmware, secure boot | 8 to 15 days | €12,000 to €25,000 |
| IoT product | Device, firmware, radio, app and cloud | 10 to 20 days | €15,000 to €30,000 |
| Automotive ECU | One ECU: hardware, diagnostics, networks | 15 to 30 days | €20,000 to €45,000 |
| OT / industrial | One plant segment or control system | 8 to 15 days | €12,000 to €25,000 |
All prices excluding VAT. Ranges are typical market prices in Germany and the EU, not a binding offer. You get a fixed price after a short scoping call.
What drives the price
Four things decide the number
Depth
Black box takes longest for the same result. With documentation or source code we find more in fewer days.
Hardware
Physical attacks, lab setups and destroyed samples cost time. Pure software tests are cheaper.
Evidence
Reports for regulators or customers, such as CRA or ISO/SAE 21434 evidence, need more documentation.
More for the same budget
Why self-hosted AI changes the math
A large part of every pentest is reading: firmware, code, API definitions, scan results. Our testers hand that work to AI models that run on our own hardware. No cloud service is involved, and nothing about your systems leaves our lab.
The days you pay for go further. Where a classic test of the same budget samples the most likely weak spots, we can look at more endpoints, more firmware and more configurations, and still verify every finding by hand.
- Self-hosted models, no data leaves our lab
- More coverage in the same number of days
- Human testers verify and exploit every finding
- Same fixed price, agreed up front
Be careful with cheap
What a €1,500 "pentest" usually is
Offers far below these ranges are almost always automated vulnerability scans with a logo on the report. They list known issues and miss the ones that hurt: broken access control, logic flaws, chained attacks.
Ask any provider three questions: how many days of manual testing are included, who does the testing, and whether a retest is part of the price.
FAQ
Pentest cost FAQ
How much does a penetration test cost?
Typically between €3,000 for a small external infrastructure test and €45,000 for a complex automotive ECU. Most web application tests cost €6,000 to €15,000. The price follows the number of testing days.
What is a typical day rate for a pentester?
In Germany, day rates for professional penetration testers are typically between €1,200 and €1,800, depending on specialisation. Hardware and automotive testing is at the upper end.
Do you offer fixed prices?
Yes. After a 15-minute scoping call you get a fixed-price offer with the scope in writing. If we need longer than planned, that is our risk.
Is the retest included?
Yes. After you have fixed the findings, we retest them and confirm which ones are closed.
Why is an IoT or automotive test more expensive than a web test?
It covers more layers: hardware, firmware, radio or vehicle networks, app and cloud. It also needs lab equipment and sample devices, and physical attacks take time.
Get started
Get your fixed price in 15 minutes
The table gives you the range. A short call gives you the exact number for your system.
- Fixed-price offer after the call
- Scope in writing, so you know what is tested
- Retest included
Your call is withTom ZaubermannFounder & CEO, Zyberum
Or send us a message
We reply within one business day.