# What a penetration test costs, in real numbers.

> A penetration test typically costs between €3,000 and €45,000, depending on the type and size of the target. A web application pentest usually costs €6,000 to €15,000, a mobile app €5,000 to €12,000, a cloud assessment €6,000 to €12,000, and a complete IoT product test €15,000 to €30,000. Prices follow the testing days needed; day rates in Germany are typically €1,200 to €1,800. Zyberum agrees a fixed price after a 15-minute scoping call.

What does a penetration test cost? Typical price ranges for web, API, mobile, cloud, network, IoT, hardware and automotive pentests, and what drives the price.

Source: https://zyberum.com/pentest-cost

Most providers hide prices behind a contact form. Here are the ranges you can expect, what moves the price up or down, and why our self-hosted AI gives you more coverage for the same budget.

## Price ranges by test type

Market ranges for a professional, manual penetration test. Your fixed price depends on the scope.

| Test | Typical scope | Testing time | Typical price |
|---|---|---|---|
| Web application | One application, 2 to 4 roles, including its API | 5 to 10 days | €6,000 to €15,000 |
| API | One REST or GraphQL API, 20 to 60 endpoints | 3 to 6 days | €4,000 to €9,000 |
| Mobile app | One app per platform, including backend API | 4 to 8 days | €5,000 to €12,000 |
| External infrastructure | Internet-facing systems of one company | 2 to 5 days | €3,000 to €7,500 |
| Internal network & Active Directory | One site or domain, assumed breach | 5 to 12 days | €7,500 to €18,000 |
| Cloud | AWS, Azure or Microsoft 365 tenant | 4 to 8 days | €6,000 to €12,000 |
| Hardware & embedded | One device: interfaces, firmware, secure boot | 8 to 15 days | €12,000 to €25,000 |
| IoT product | Device, firmware, radio, app and cloud | 10 to 20 days | €15,000 to €30,000 |
| Automotive ECU | One ECU: hardware, diagnostics, networks | 15 to 30 days | €20,000 to €45,000 |
| OT / industrial | One plant segment or control system | 8 to 15 days | €12,000 to €25,000 |

All prices excluding VAT. Ranges are typical market prices in Germany and the EU, not a binding offer. You get a fixed price after a short scoping call.

## Four things decide the number

### Size

Number of roles, features, endpoints, interfaces or systems. More surface means more days.

### Depth

Black box takes longest for the same result. With documentation or source code we find more in fewer days.

### Hardware

Physical attacks, lab setups and destroyed samples cost time. Pure software tests are cheaper.

### Evidence

Reports for regulators or customers, such as CRA or ISO/SAE 21434 evidence, need more documentation.

## Why self-hosted AI changes the math

A large part of every pentest is reading: firmware, code, API definitions, scan results. Our testers hand that work to AI models that run on our own hardware. No cloud service is involved, and nothing about your systems leaves our lab.

The days you pay for go further. Where a classic test of the same budget samples the most likely weak spots, we can look at more endpoints, more firmware and more configurations, and still verify every finding by hand.

- Self-hosted models, no data leaves our lab
- More coverage in the same number of days
- Human testers verify and exploit every finding
- Same fixed price, agreed up front

## What a €1,500 "pentest" usually is

Offers far below these ranges are almost always automated vulnerability scans with a logo on the report. They list known issues and miss the ones that hurt: broken access control, logic flaws, chained attacks.

Ask any provider three questions: how many days of manual testing are included, who does the testing, and whether a retest is part of the price.

**Included in our price**

- Scoping and test plan
- Manual testing by certified testers
- Report with proof-of-concept and fixes
- Debrief with your engineers
- Retest after remediation

## FAQ

**How much does a penetration test cost?**

Typically between €3,000 for a small external infrastructure test and €45,000 for a complex automotive ECU. Most web application tests cost €6,000 to €15,000. The price follows the number of testing days.

**What is a typical day rate for a pentester?**

In Germany, day rates for professional penetration testers are typically between €1,200 and €1,800, depending on specialisation. Hardware and automotive testing is at the upper end.

**Do you offer fixed prices?**

Yes. After a 15-minute scoping call you get a fixed-price offer with the scope in writing. If we need longer than planned, that is our risk.

**Is the retest included?**

Yes. After you have fixed the findings, we retest them and confirm which ones are closed.

**Why is an IoT or automotive test more expensive than a web test?**

It covers more layers: hardware, firmware, radio or vehicle networks, app and cloud. It also needs lab equipment and sample devices, and physical attacks take time.

---
Zyberum GmbH. Canonical page: https://zyberum.com/pentest-cost