vPenTest pricing: the $2 promo, per-IP rates and contract terms

By The PenTest Index · Sources checked October 10, 2026

vPenTest pricing is by quote: Vonahi Security, a Kaseya company, lists no standard rate. Two public figures exist. Kaseya advertised $2 per endpoint per month to MSPs in an April 2025 webinar, and a UK reseller lists £8 per internal IP and £12 per external IP. Neither is your price. Your order's unit, minimum and term decide that.

Our read: vPenTest is worth a quote if you want regular internal and external network tests and you know roughly how many devices or IP addresses you'd cover. That goes for managed service providers (MSPs) testing client networks and for in-house IT teams. It's the wrong purchase if you need a web app or API test, a specifically guaranteed hands-on human-led test, or one test with no subscription. And before you sign anything, get three things in writing: what counts as a billable unit, how long you're committed, and whether a re-test uses up licenses.

If that sounds like you, ask Vonahi for a quote and take the eight questions below with you.

Request a vPenTest quote

How much does vPenTest cost?

There is no public list price. Here is every public price signal we found, and how much weight each one can carry.

What's public	Amount	Who said it	What it does not tell you
Vonahi's pricing page	None. It asks you to fill out a form for a tailored plan.	Vonahi	Everything
"Endpoint Licensing Model" webinar page, dated April 22, 2025	$2 per endpoint per month, described as promo pricing	Kaseya, to MSPs	Whether it's still offered, who qualifies, the minimum, the term, what an "endpoint" is
UK G-Cloud 15 rate card, dated January 30, 2026	£8 per internal IP, £12 per external IP. Or £1,200 for a combined internal and external package up to 250 IPs, plus £900 for each extra 250 internal IPs. Listed under a "per month-assessment model".	Kent MSP Ltd, a reseller, for UK public sector buyers	Vonahi's own price. This is one reseller's managed service, in pounds.
Vonahi partner page	No amount. An annual subscription based on a block of IPs each month.	Vonahi, to MSPs	The size and price of a block
Vonahi homepage	Says more than 60% below a traditional test	Vonahi	A price. A percentage with no base isn't one.

All checked October 10, 2026. These are published statements. None is a quote, and we did not buy vPenTest.

You may also see a "$300 a month" starting price on a comparison site. It gives no source, and we could not match it to anything Vonahi or Kaseya publishes. Don't budget from it.

What would $2 per endpoint per month add up to?

At that rate, 100 endpoints come to $200 a month, or $2,400 over 12 months. This is our arithmetic on an advertised figure, not a plan Kaseya has confirmed it will sell you.

Endpoints	1 month	12 months	36 months
25	$50	$600	$1,800
100	$200	$2,400	$7,200
250	$500	$6,000	$18,000

US dollars. This assumes you qualify for the $2 rate and every endpoint listed is billable. No minimum, setup fee, tax or contract length has been confirmed for these numbers. The 36-month column is there because long terms change the math, not because Kaseya says 36 months is required. And a monthly rate is not a right to cancel monthly.

What does the UK reseller's rate card add up to?

It gives a real anchor, and it shows the package beating the per-IP rate fast. Again, our arithmetic, in pounds:

The package for a year: £1,200 × 12 = £14,400. The same listing shows a 15% discount at every contract size, which makes it £12,240.
Per IP at the full 250: £4.80 a month, against £8 or £12 bought one at a time.
Where the package wins: once (£8 × internal IPs) + (£12 × external IPs) passes £1,200, if your scope qualifies for the combined package. That's above 150 internal IPs at the listed rate, if the reseller allows that scope.
500 IPs with the listed multi-site internal expansion: £1,200 + £900 = £2,100 a month, £25,200 a year, or £21,420 after the discount, if the reseller confirms that package fits the scope.

Say you run IT for a UK council office with 180 internal IPs and 20 external ones, tested monthly. Per IP, that's (180 × £8) + (20 × £12) = £1,680 a month. The package is £1,200. You'd save £480 a month before the framework discount, or £408 after the same 15% discount applies to both options.

Two things the document doesn't settle: whether "up to 250 IPs" counts internal and external together, and whether the per-IP rate is charged per test or per month. Ask the reseller. The listing also shows add-ons such as enhanced support at £250 per organisation a month and on-site work at £850 a day.

How vPenTest pricing works: endpoints, IP pools and IP blocks

You buy a set number of licenses, you spend one on each target you test, and what you don't use is gone. Think of phone minutes that reset each month, not a bill for one job.

Kaseya's vPenTest Terms of Use (updated November 3, 2025) say a license is needed for testing on each test target, and that licenses come in types such as internal IPs and external IPs. Unused licenses for a period do not roll over. Go over your plan and Kaseya may pause testing or bill you for the extra.

Three model names show up in company materials. Your order should say which one you're on.

Endpoint licensing. The newer model from the $2 webinar. Kaseya doesn't publish how an endpoint is counted.
IP Pool. Kaseya's help pages describe this as the current MSP model. Its base subscription includes 20 "prospecting tests" a month for MSPs to run on sales prospects.
IP Block. The same help page calls this the legacy model. The partner page still describes an annual subscription based on a block of IPs each month.

An endpoint and an IP address are not the same thing. One server can hold several IPs. One laptop can show up on two networks. So don't assume the $2 figure maps onto your IP count.

Before you ask for a quote, find your number. Kaseya's help pages describe a free IP Estimator scan for internal ranges that doesn't draw down your IP balance. It doesn't estimate external IPs, so count your public addresses yourself.

One buyer review on Gartner Peer Insights says licensing follows the IPs the tool detects, and that re-tests kept turning up more of them. That's one buyer's account and we couldn't verify it. It is a good reason to ask question 2 below.

What does a vPenTest contract commit you to?

If you buy a fixed-term subscription from Kaseya directly, you owe the whole term, it renews by itself for the same length, and you need to give at least 30 days' notice to stop renewal. That comes from the Kaseya Master Agreement (updated October 7, 2025) and the vPenTest Terms. Your signed order can change any of it, so read the order first.

Term	What the published text says	What it means for you
Length	Set on your order as the "Committed Service Term"	Not public. Ask.
Leaving early	You owe 100% of the remaining fees for the term, at once, unless you terminate for Kaseya's uncured material breach as specified in the agreement	Sign 36 months at $200 a month and leave after paying 12 months for an ordinary cancellation: $4,800 is still due
Renewal	Renews for an equal term at your last quantity unless you opt out	A 3-year deal renews for 3 more
Notice (fixed term)	At least 30 days before the term ends; month-to-month cancellation follows separate calendar-month rules	Term ends December 31: give notice by December 1
Renewal price	On fixed-term automatic renewals: the last price plus up to 5%, plus the prior year's rise in the US Consumer Price Index. Exchange-rate, tariff or similar government-charge adjustments are also permitted.	Month-to-month plans can rise on 30 days' notice
Cutting your count	Quantities can go up mid-term but not down, unless the product's terms allow it. The vPenTest terms we read don't say they do.	Start with a count you're sure of
Going over	Kaseya may pause testing or invoice the extra	Know your live count
Unused licenses	Forfeited each license period	A license you don't use this period is gone
Refunds	Fees are non-refundable except for billing errors or other exceptions stated in the agreement
Reports	Kept 90 days by default unless you set longer. No access after the subscription ends.	Download every report
Fixing what's found	Not included	Budget for it

Buying through an MSP? Kaseya's ordering and payment section says it doesn't apply to you. Your MSP sets your price and your terms. Ask the MSP the same questions.

This is a plain-English reading of public terms, not legal advice.

Check a vPenTest quote

When a quote arrives, turn it into five numbers: cost per unit, cost per test, total owed over the term, what you'd owe if you left early, and the last day to give notice.

Here's a made-up example. An MSP is quoted $2 per endpoint per month for 100 endpoints on a 36-month term starting January 1, 2027. It runs 12 tests a year.

Monthly: 100 × $2 = $200
Per test: $2,400 a year ÷ 12 tests = $200
Total commitment: $200 × 36 = $7,200
Leave after paying 12 months for an ordinary early cancellation: 24 months × $200 = $4,800 still owed
Term ends December 31, 2029. Notice is due by December 1, 2029.
Price-lock illustration at the full 5% increase, before inflation and permitted extra adjustments: $200 × 1.05 = $210 a month

The same $2 looks very different at 12 months ($2,400 total) and 36 months ($7,200 total). That's why the term matters as much as the rate.

Runs in the browser. Sends nothing.

vPenTest quote checker

Turn a vPenTest quote into cost per unit, cost per test, total commitment, early-exit amount, notice-by date and an illustrative automatic-renewal price-lock calculation.

Counts and prices only. No IP addresses, hostnames, credentials, findings or network diagrams. Nothing is stored or sent.

The eight questions

01Which licensing model is on our order (endpoint, IP Pool or IP Block)? Is the $2 per endpoint per month price available to us?
02What counts as a billable unit? Is an IP counted when we list it or when it's found live?
03What is the minimum quantity? When do licenses reset, and can we move them between clients?
04What are all the charges: unit price, setup, add-ons and the overage rate? What is due now, and what is the total across the full term?
05How long is the term? What is the last day to give notice, and what is the price rule at renewal?
06What does a full test include, and who reviews the report before release?
07After we fix findings, does a re-test use licenses again? Do we get a new report?
08May we give the report to [auditor / insurer / customer]? How long is it stored?

Holding a quote from another provider too? Line them up with the same questions using our Quote Check.

What does vPenTest test, and what is left out?

vPenTest runs automated internal and external network penetration tests against the IP addresses you choose. It does not sell web application tests anymore, and it doesn't fix what it finds.

A penetration test (pentest) tries to break in the way an attacker would. A vulnerability scan only lists weaknesses. Vonahi's service page says vPenTest goes past scanning: it tries to exploit what it finds, then tries to gain more access and move to other systems. Kaseya's terms confirm the tool attempts exploitation and may copy sample data, such as passwords or file contents, as proof. They also warn that exploitation can make a device misbehave and need a restart.

What's left out matters more for your budget:

Web apps and APIs. Kaseya's May 19, 2026 release notes say the internal and external web application pentest types are no longer offered. A vPenTest network quote is not an app test.
A person doing the testing. vPenTest is sold as automated. Kaseya's terms say testing may be automated and/or manual, but they don't promise a dedicated human tester for your assessment. Vonahi's partner page says each report goes through a 48-hour quality review by its security consultants. A person checking a report is not the same as a person running the test.
Fixing findings. The terms say remediation is yours to do.
Prospecting tests as proof. The free monthly prospecting tests in the IP Pool model skip that quality review. Kaseya's help page says they are not a full pentest and can't be used for compliance or cyber insurance.

Vonahi says reports arrive within 48 hours of a test finishing.

Will an auditor, insurer or customer accept a vPenTest report?

Only they can say, so ask them before you buy. Vonahi says vPenTest meets PCI, HIPAA and SOC 2 needs and cyber insurance requirements. Kaseya's Master Agreement says it makes no promises about compliance with rules for a specific industry unless it does so in writing. A vendor's claim is not your auditor's approval.

Ask the person who wants the report three things: Is an automated network test enough? Does the tester need a specific credential? What must the report contain?

Two details to check while you're at it.

Sharing. The vPenTest terms give you the right to use a report internally or share it with your own service providers to find and fix problems. They don't spell out handing it to an auditor, insurer or customer. The May 2026 release notes do describe a one-page "Clean Assessment Certificate" meant to be shared when an external test finds nothing significant. Ask Vonahi to confirm in writing that you can send the full report to your named recipient.

CREST. CREST is a body that accredits security testing companies. Its marketplace lists Kaseya with a Penetration Testing accreditation and shows the United Kingdom and Europe. Vonahi says CREST-certified vPenTest reports are available across Europe, the Middle East, Africa and Australasia. It makes no such claim for the Americas. If you're in the US and your recipient asks for CREST, raise it before you sign.

For the wider question of scan versus pentest, see penetration testing vs vulnerability scanning.

Who should ask for a vPenTest quote, and who should look elsewhere?

Ask for a quote if you want repeatable network tests on a known count. Look elsewhere if your must-have is an app test, a contractually guaranteed hands-on human test or a single test.

Your situation	Best first move	The thing that could rule it out
MSP testing several client networks every month or quarter	Request a vPenTest quote	Pool rules, minimum and term you can't live with
In-house IT team wanting regular internal and external network tests	Request a quote for your exact IP count	A monthly subscription that costs more than the one or two tests you'd run
You need one network test a year for an insurance form	Compare a per-test offer first	Paying 12 months for one report
SaaS team needing a web app or API test	A dedicated app or API test	vPenTest no longer offers those test types
Your auditor requires human-led testing	Get the requirement in writing, then shop	An automated test with a reviewed report does not itself prove the required human-led work was done
Your MSP or a platform you already pay for includes a network pentest	Check that report against the request before buying anything	Nothing. You may not need to buy.

A few network-capable offers do publish a price. They're different kinds of work sold in different units, so treat this as a map, not a like-for-like comparison. From our index, checked October 7 and 8, 2026:

Synack Sara Pentest: AI-led, one low-complexity web app or 100 host IPs, from $4,181 per test. A separate platform line item is required.
Synack SynackST: one human tester, up to 100 host IPs, from $10,283 per test. Same platform line item.
Pentest-Tools.com NetSec: a toolkit you run yourself, advertised from $95 a month for five assets.

If you're not sure whether the request is for a network test, an app test, or just proof of work already done, write down what your report recipient needs before you compare prices. Find My PenTest Match walks you through it and gives you a scope checklist to copy or print. It's free, there's no sign-up, and nothing is sent to providers. Our compared offers are mostly web app and API tests, so it's most useful if that's where you've landed.

Find My PenTest Match

Questions to send before you sign

Send these with your target count and ask for the answers on one written order. Two quotes can't be compared until both answer the same questions.

We're evaluating vPenTest for [internal / external network testing] across [number] organizations, about [number] endpoints or [number] internal and [number] external IPs, tested [monthly / quarterly / yearly]. Please confirm in writing:

Which licensing model is on our order (endpoint, IP Pool or IP Block)? Is the $2 per endpoint per month price available to us?

What counts as a billable unit? Is an IP counted when we list it or when it's found live?

What is the minimum quantity? When do licenses reset, and can we move them between clients?

What are all the charges: unit price, setup, add-ons and the overage rate? What is due now, and what is the total across the full term?

How long is the term? What is the last day to give notice, and what is the price rule at renewal?

What does a full test include, and who reviews the report before release?

After we fix findings, does a re-test use licenses again? Do we get a new report?

May we give the report to [auditor / insurer / customer]? How long is it stored?

This is a request for a quote. It is not permission to test anything. Written authorization from the owner of each network has to be settled separately, and Kaseya's terms make getting it your job. Don't put passwords, findings or network diagrams in the email.

Your questions are ready. Send them with the same scope you want priced.

Request a vPenTest quote

How we checked

On October 10, 2026, we read Vonahi's and Kaseya's public pricing, partner and help pages, the Kaseya Master Agreement, the vPenTest Terms of Use, the May 2026 release notes, a UK government marketplace listing and CREST's listing. We did not get a sales quote, buy a subscription, run a test or see a customer's report. Where the public record runs out, we've said so and given you the question to ask.

We have no commercial relationship with Vonahi or Kaseya, and the links to them are plain links. See how we check offers and how we make money.

Sources

All read October 10, 2026, except where noted.

Vonahi Security: Get a vPenTest Pricing Quote
Kaseya: Proactively Eliminating Security Gaps webinar page (webinar dated April 22, 2025)
Vonahi Security: Become a Partner
Vonahi Security: homepage and network penetration testing page
Kaseya: vPenTest Terms of Use (updated November 3, 2025)
Kaseya: Master Agreement (updated October 7, 2025)
Kaseya help: Prospecting test for MSP partners
Kaseya help: vPenTest release notes, May 19, 2026
UK Digital Marketplace, G-Cloud 15: Kent MSP Ltd listing and pricing document (dated January 30, 2026)
CREST Marketplace: Kaseya
Vonahi Security: CREST accreditation page
The PenTest Index: published offer comparison for Synack and Pentest-Tools.com prices (checked October 7 and 8, 2026)