Updated
Short answer
Most small business penetration tests in the US cost between $5,000 and $15,000 in 2026. A single web app or external network test usually starts around $4,000, internal plus external testing for 50 to 200 employees runs about $10,000 to $20,000, and a full red team exercise starts around $20,000. A quote under about $2,000 is usually for an automated scan.
Typical price ranges
- External network or one web app: about $4,000 to $20,000 depending on size.
- Internal network: about $5,000 to $18,000.
- Internal and external for 50 to 200 employees: about $10,000 to $20,000.
- Minimum web app test for a SOC 2 audit: about $6,000 to $13,000.
- AI or LLM feature test: published fixed prices start around $4,500 for one LLM feature and $12,000 or more for AI agents with tool access.
- Full red team exercise: about $20,000 to $120,000 or more.
What drives the price
Price follows effort. The biggest drivers are how many systems are in scope (IP addresses, apps, user roles, API endpoints), whether testing happens from outside only or also from inside your network, and how deep the tester goes.
Compliance adds cost when the report must follow a specific format, such as PCI DSS, or when your auditor wants evidence that issues were retested and fixed.
How to tell a real test from a scan
- A real test names the people doing the work and how many days they will spend.
- It includes manual testing: chaining small issues together and testing logins and business logic by hand. A list of scanner findings alone does not count.
- It includes a retest of fixed issues, ideally at no extra cost.
- The report explains the business impact and the fix for each issue. CVE numbers alone are not a report.
How Joxura prices
We quote each test as a single price after a free scoping call. Packages include a plain-English report, a retest of fixed issues and an attestation letter for your auditor or insurer.
Related questions
How often should a small business get a penetration test?
At least once a year and after major changes, such as a new app, a cloud migration or a new AI feature. PCI DSS requires internal and external testing at least every 12 months, and the FTC Safeguards Rule requires annual testing for covered financial businesses without continuous monitoring.
Is a cheaper automated pen test good enough?
Automated testing is useful for frequent checks, but it misses issues that need human judgment, such as broken access control and business logic flaws. Many auditors and enterprise customers expect a human-led test at least once a year.