{
  "checked_date": "2026-10-08",
  "scope": "Reproducible arithmetic for this selected compilation; not a validation of proprietary forecasts, a representative buyer-price survey, or a new experiment.",
  "files": {
    "eurostat-ict-security-tests-by-country-2024.csv": {
      "rows": 35,
      "sha256": "76506d4968a5274087f1dc61edd4034c596c3b06e84abb2ea6f17bc12eb122e9"
    },
    "gsa-penetration-tester-ceiling-rates-2026-10-08.csv": {
      "rows": 417,
      "sha256": "b7ef9c150db20baef6169be0bf177c8bce315543dbf9d7d59903ef34324ecc77"
    },
    "gsa-pentest-contractor-listings-2026-10-08.csv": {
      "rows": 609,
      "sha256": "19ce9ba8131b8c8827bcd258dafd19271f4f632d565ef998e87eae58f47edf69"
    },
    "penetration-testing-statistics-2026.csv": {
      "rows": 100,
      "sha256": "dd2b5d6c1843e9ffac4d11341d288f175aab5f8091d3cabcc3920ae16f8625ea"
    },
    "pentest-fix-time-and-closure-benchmarks-2026.csv": {
      "rows": 73,
      "sha256": "219914b04dac20550609b14a9d346b5385b43eabd882595662d58538043f323b"
    },
    "pentest-market-size-estimates-2026.csv": {
      "rows": 35,
      "sha256": "45927126148f992c8a29d35899761b76edbb44ec3faa73a3441b685c20b69db5"
    },
    "pentest-popular-numbers-checked-2026.csv": {
      "rows": 12,
      "sha256": "9deefdcb893e78148384f53268c1f6e933e22f58df93727798260b0f6a876d73"
    },
    "pentest-published-offers-2026-10-08.csv": {
      "rows": 54,
      "sha256": "72b164ffa2683bbc736d985fae71da02bf68f38969e91ca169f4103b5900da8a"
    },
    "pentest-published-price-check-2026-10-08.csv": {
      "rows": 43,
      "sha256": "2f7748ccf2578213e32a3e4167259e79cde709cbf02b309622ea0696764bdb24"
    },
    "pentest-rule-tracker-2026.csv": {
      "rows": 22,
      "sha256": "a0709c0d35bcb9072bbf326994d1b22bc688ec5e3bce4c70535a1e375fff0901"
    }
  },
  "statistics": {
    "count": 100,
    "topics": {
      "Market size": 8,
      "Who tests": 12,
      "How often": 9,
      "Rules": 12,
      "What tests find": 8,
      "Time to fix": 15,
      "Cost": 14,
      "Providers": 4,
      "AI": 10,
      "Breaches": 6,
      "Workforce": 1,
      "Source check": 1
    },
    "unique_anchors": 100
  },
  "market": {
    "2025": {
      "records": 19,
      "minimum": "1.98",
      "q1_raw": "2.1950",
      "median_raw": "2.400000",
      "q3_raw": "2.5400",
      "maximum": "3.36",
      "mean_raw": "2.444439473684210526315789474",
      "display_q1": "2.20",
      "display_median": "2.40",
      "display_q3": "2.54",
      "display_mean": "2.44"
    },
    "2026": {
      "records": 8,
      "minimum": "2.42",
      "q1_raw": "2.7175",
      "median_raw": "2.80360",
      "q3_raw": "2.9550",
      "maximum": "3.14",
      "mean_raw": "2.82465",
      "display_q1": "2.72",
      "display_median": "2.80",
      "display_q3": "2.96",
      "display_mean": "2.82"
    },
    "2025_high_low_ratio": "1.696969696969696969696969697",
    "same_eight_firms_2025_median": "2.420825",
    "median_cagr_percent": "15.290",
    "doubling_years_at_median_cagr": 4.871694611750546,
    "illustrative_2026_at_median_growth": "2.7669600000",
    "2025_median_with_cognitive": "2.390",
    "ptaas_2026": {
      "records": 6,
      "minimum": "0.16546",
      "q1_raw": "0.7875",
      "median_raw": "1.095",
      "q3_raw": "2.250",
      "maximum": "2.81",
      "mean_raw": "1.414243333333333333333333333",
      "display_q1": "0.79",
      "display_median": "1.10",
      "display_q3": "2.25",
      "display_mean": "1.41"
    },
    "ptaas_high_low_ratio": "16.98295660582618155445424876",
    "360iresearch_endpoint_implied_cagr_percent": 19.272097913659493
  },
  "gsa": {
    "all": {
      "records": 417,
      "minimum": "57.34",
      "q1_raw": "126.800",
      "median_raw": "157.5260",
      "q3_raw": "196.8700",
      "maximum": "320.56",
      "mean_raw": "164.4571918465227817745803357",
      "display_q1": "126.80",
      "display_median": "157.53",
      "display_q3": "196.87",
      "display_mean": "164.46"
    },
    "experience_bands": {
      "0–2": {
        "records": 96,
        "minimum": "57.34",
        "q1_raw": "108.1700",
        "median_raw": "130.69385",
        "q3_raw": "154.1150",
        "maximum": "273.3425",
        "mean_raw": "137.5243614583333333333333333",
        "display_q1": "108.17",
        "display_median": "130.69",
        "display_q3": "154.12",
        "display_mean": "137.52"
      },
      "3–5": {
        "records": 163,
        "minimum": "69.3636",
        "q1_raw": "125.676100",
        "median_raw": "152.19350",
        "q3_raw": "179.4000",
        "maximum": "301.6193",
        "mean_raw": "156.5765699386503067484662577",
        "display_q1": "125.68",
        "display_median": "152.19",
        "display_q3": "179.40",
        "display_mean": "156.58"
      },
      "6–9": {
        "records": 116,
        "minimum": "84.017",
        "q1_raw": "150.205100",
        "median_raw": "181.220",
        "q3_raw": "211.808450",
        "maximum": "307.17",
        "mean_raw": "183.9215991379310344827586207",
        "display_q1": "150.21",
        "display_median": "181.22",
        "display_q3": "211.81",
        "display_mean": "183.92"
      },
      "10+": {
        "records": 42,
        "minimum": "126.59",
        "q1_raw": "175.614675",
        "median_raw": "195.600",
        "q3_raw": "228.5500",
        "maximum": "320.56",
        "mean_raw": "202.8434261904761904761904762",
        "display_q1": "175.61",
        "display_median": "195.60",
        "display_q3": "228.55",
        "display_mean": "202.84"
      }
    },
    "vendor_name_count": 135,
    "contract_count": 139,
    "distinct_title_count": 149,
    "data_timestamps": [
      "2026-10-09T02:00:03Z"
    ],
    "forty_hour_illustration_raw_usd": "6301.0400",
    "directory_contract_rows": 609,
    "directory_distinct_contractor_names": 591
  },
  "prices": {
    "disclosure": {
      "Priced offer on a pricing or service page": 15,
      "No own-test price found on the checked pages": 21,
      "Figure for its own tests only in a blog post, FAQ page, news post or older page": 7
    },
    "current_page_price_yes_no": {
      "Yes": 15,
      "No": 28
    },
    "no_current_price_percent": 65.11627906976744,
    "current_price_percent": 34.883720930232556,
    "price_only_elsewhere_percent": 16.27906976744186,
    "no_price_in_checked_pages_percent": 48.837209302325576,
    "usd_non_ai": {
      "records": 10,
      "providers": 2,
      "minimum_starting_price": "3000",
      "maximum_starting_price": "12400",
      "rows": [
        {
          "provider": "Software Secured",
          "offer": "Web & API Pentesting",
          "amount": "10800",
          "currency": "USD",
          "scope_or_unit": "web application and API",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "Mobile App Pentesting",
          "amount": "5400",
          "currency": "USD",
          "scope_or_unit": "mobile application",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "External Network Pentest",
          "amount": "5400",
          "currency": "USD",
          "scope_or_unit": "external network",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "Internal Network Pentesting",
          "amount": "7700",
          "currency": "USD",
          "scope_or_unit": "internal network",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "AI Pentesting",
          "amount": "10800",
          "currency": "USD",
          "scope_or_unit": "a test of AI systems, done by people",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "IoT Pentesting",
          "amount": "10800",
          "currency": "USD",
          "scope_or_unit": "device, firmware, mobile app, cloud",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "Hardware Pentesting",
          "amount": "12400",
          "currency": "USD",
          "scope_or_unit": "hardware",
          "url": "https://www.softwaresecured.com/pricing"
        },
        {
          "provider": "Software Secured",
          "offer": "Urgent pentest for enterprise deals",
          "amount": "5400",
          "currency": "USD",
          "scope_or_unit": "\"Pentesting for SaaS to Unblock Enterprise Deals\"; the page does not list the scope",
          "url": "https://www.softwaresecured.com/service/urgent-penetration-test"
        },
        {
          "provider": "Prescient Security",
          "offer": "Compliance Penetration Testing",
          "amount": "3000",
          "currency": "USD",
          "scope_or_unit": "testing aligned to SOC 2, ISO 27001 or customer questionnaires",
          "url": "https://prescientsecurity.com/penetration-testing-services/cacilian/pricing"
        },
        {
          "provider": "Prescient Security",
          "offer": "Traditional Penetration Testing",
          "amount": "6000",
          "currency": "USD",
          "scope_or_unit": "\"Full-scope, human-led engagement\"",
          "url": "https://prescientsecurity.com/penetration-testing-services/cacilian/pricing"
        }
      ]
    },
    "usd_ai": {
      "records": 2,
      "rows": [
        {
          "provider": "Intruder",
          "offer": "Same day pentest",
          "amount": "4000",
          "currency": "USD",
          "scope_or_unit": "one white-box web application test",
          "url": "https://www.intruder.io/pentest-pricing"
        },
        {
          "provider": "Prescient Security",
          "offer": "Cait AI Penetration Tester, one time",
          "amount": "1500",
          "currency": "USD",
          "scope_or_unit": "one asset",
          "url": "https://prescientsecurity.com/penetration-testing-services/cacilian/pricing"
        }
      ]
    },
    "printed_dollar_non_ai": {
      "records": 30,
      "providers": 8,
      "warning": "Printed numerals are not a single-currency comparison."
    },
    "printed_dollar_ai": {
      "records": 4,
      "providers": 4,
      "warning": "Excludes Aikido's broad scope-based range and Synack's required-platform fee."
    }
  },
  "timing": {
    "human_time_or_effort_records": 16,
    "ai_numeric_records": 9,
    "ai_groups": {
      "Same day or within 24 hours": 6,
      "Does not promise results within 48 hours": 1,
      "": 32,
      "Excluded: source unavailable": 1,
      "No number": 1,
      "24 to 48 hours": 1,
      "Longer than 48 hours": 1
    },
    "milestone_limit": "First reports, initial results, completed tests, elapsed time, effort days and coverage windows must not be treated as one identical duration."
  },
  "rules": {
    "active_tracker_groups": {
      "requires": 8,
      "suspended": 1,
      "example": 8,
      "not_required": 4
    },
    "proposal_rows": 1,
    "requires_default_intervals": {
      "annual": 5,
      "three_year": 2,
      "organization_defined": 1
    },
    "limit": "Intervals are coded from source clauses, with exceptions and the suspended rollout separately retained."
  },
  "official_surveys": {
    "uk_size_percentages": [
      10,
      21,
      38,
      60
    ],
    "large_micro_ratio": 6.0,
    "eurostat_numeric_cells": 206,
    "eurostat_missing_cells": 4,
    "eurostat_cells_checked": 210,
    "eu_aggregate": {
      "pct_enterprises_10plus_2024": "34.64",
      "pct_10_49_2024": "29.76",
      "pct_50_249_2024": "54.07",
      "pct_250plus_2024": "78.1",
      "pct_enterprises_10plus_2022": "34.56",
      "pct_enterprises_10plus_2019": "35.18"
    }
  },
  "benchmarks": {
    "fix_values_days": [
      "38",
      "39",
      "39",
      "43",
      "54.81",
      "58"
    ],
    "minimum_days_divided_by_14": "2.714285714285714285714285714",
    "maximum_days_divided_by_14": "4.142857142857142857142857143",
    "march_1_plus_38_days": "2026-04-08",
    "march_1_plus_58_days": "2026-04-28",
    "high_risk_resolution_rates_percent": {
      "API": "77.3",
      "Web application": "73.7",
      "AI and LLM application": "38.4",
      "External network": null,
      "Mobile application": "71.2",
      "Cloud": "63.5",
      "Internal network": "54.1",
      "Desktop": "40.2"
    },
    "unresolved_complements_percent": {
      "API": "22.7",
      "Web application": "26.3",
      "AI and LLM application": "61.6",
      "External network": null,
      "Mobile application": "28.8",
      "Cloud": "36.5",
      "Internal network": "45.9",
      "Desktop": "59.8"
    },
    "api_ai_gap_percentage_points": "38.9",
    "industry_half_lives_days": {
      "Software": "38",
      "Professional services": "45",
      "Hospitality": "50",
      "Healthcare": "55",
      "Finance": "55",
      "Education": "69",
      "Manufacturing": "73",
      "Retail": "84",
      "Utilities": "96",
      "Entertainment": "98"
    },
    "industry_half_life_spread_days": "60",
    "slow_fast_half_life_ratio": 24.9,
    "slow_fast_half_life_difference_days": 239
  },
  "source_checks": {
    "popular_claims": 12,
    "verdicts": {
      "Misquoted": 5,
      "Out of date": 4,
      "Weak method": 1,
      "No source found": 2
    },
    "traced_origins": 10,
    "untraced_claims": 2
  },
  "context_math": {
    "cve_2025_growth_percent": 20.37827182673353,
    "ibm_days_183_plus_64": 247,
    "fortra_at_least_yearly_percent": 83
  }
}