Web application penetration testing services: prices, scope and retest terms compared

By The PenTest Index · Offers checked October 8, 2026 · How we check offers

Web application penetration testing services are paid assessments where testers attack your web app the way an intruder would, then report what they found. Eight providers we checked on October 8, 2026 publish a starting price or price example for testing led by people, from $3,000 to about $12,000. Your user roles, API and retest deadline decide which figure applies.

This site may contain affiliate or referral links. If you buy through one, we may be compensated. How we make money

Below, one example job is priced against each published offer, with the deadline that rules some of them out.

Web application penetration testing services compared by price, scope and retest terms

Most providers describe this service in the same words and show no price. So we took the ones that do publish terms and asked each the same question.

The example job. Say you run a 30-person software company. You have one web app, the API it uses, and three kinds of signed-in user: admin, manager and viewer. Two customer organizations (tenants) share the app, and their data must stay apart. You will not share source code. A customer wants the report. Your developers need about six weeks to fix what the test finds, so you expect to ask for the fix check on day 45, counting from the day the findings and report reach you.

This buyer is made up. No provider has quoted for it. The prices are what each provider's own page showed on October 8, 2026, and the arithmetic is ours.

Table 1. Tests led by people, with a published price (A to Z)

Each offer name links to the page we read. Astra, Prescient and Software Secured identify US dollars, as does Blaze’s linked shop. The other pages show "$" with no currency code, so confirm the currency, tax and amount due at signing on your quote. "Supported" means the published wording covers that one condition. It is not a verdict on testing quality, and we have not bought or run any of these tests.

What this means for the example job

Three offers deserve a closer look for three roles and a fix check on day 45, with these conditions still to settle:

• Blaze Essentials, from $7,499, if the fix check can be scheduled within 90 days of the initial report and the 4-hour cap covers the work.
• Siemba Expert, from $3,000, only if the app has fewer than 20 pages and fewer than 5 APIs, and the day-45 request can be retested within its 60-day window.
• Software Secured, from $10,800, with the longest window and a Web & API offer that explicitly names multi-tenant flaws; confirm the three-role scope and when the 12 months start.

Triaxiom's retest terms fit too if the retest is completed within 90 days of report delivery, but its price examples do not price this job and the API may be quoted apart. Astra Expert is ruled out by its 30-day request window unless Astra confirms an extension in writing. Pentest-Tools.com, Prescient and Synack each stay open until the retest terms are confirmed; Synack also needs the platform charge confirmed.

Two things would change this. Move the fix-check request to day 25 and it fits Astra’s request window, provided at least half the Critical and High findings are fixed; roles and target scope still need confirmation. Raise the roles to five and Blaze moves to Assurance (from $8,999), Siemba's starting price stops applying, and Pentest-Tools.com starts from $7,900 (3,400 + 5 × 900).

A starting price is not a quote. If one of the three fits your app, go straight to it:

View Blaze packages

View Siemba Expert Engagements

View Software Secured pricing

Price your own scope

Change the example to match your app. Enter counts only.

Signed-in user rolesNot sure012345678910

APIs the app usesNone1 to 45 or moreNot sure

Pages or screensFewer than 2020 or moreNot sure

Separate admin loginYesNoNot sure

Can you share source codeYesNo

Day you expect to ask for the fix check, counted from the day the findings and report reach you

Not sure

Do you want a fix check includedYesNo

Enter counts only. Nothing you enter is sent to us.

Reset to exampleResults update as you change the inputs.

Published starting amounts, fix-check findings and questions for the selected offers.

Offer	Published starting amount, not a quote	Finding for the fix check	Question to send
Astra · Pentest Expert	$5,999 a year for 1 target.	Mismatch The request day is after the published 30-day window.	Can you include a manual re-scan requested on day 45 after findings are reported, and what does the extension cost? Copy question
Blaze · Essentials	From $7,499.	Unresolved The MSA requires scheduling within 90 days of the initial report, subject to availability. One round is capped at 4 hours; extra rounds, time beyond the cap and late requests cost extra. Confirm the schedule.	Can you schedule our fix-validation round within 90 days of the initial report, and will the 4-hour cap cover it? Copy question
Pentest-Tools.com	Gray box, starting from $6,100 ($3,400 + 3 × $900). API not mentioned on the page.	Unresolved Retesting is not stated on the priced page.	Is our API in scope at this price, and how many retests are included, until when? Copy question
Prescient · Traditional	Starting at $6,000 USD, before tax; scales with roles and API endpoints.	Unresolved Retest terms are not stated on the pricing page for this offer.	How many retests are included in a Traditional engagement, and until when? Copy question
Siemba · Expert Engagement	Starting at $3,000.	Unresolved Free within 60 days of the report; a request-by deadline is not stated.	How many retest rounds are free within the 60 days? Copy question
Software Secured · Web & API	Starts at $10,800 USD.	Unresolved 3 rounds over 12 months on the Web & API card; the start date and mapping to the separate 1, 3 or unlimited package counts are not stated.	Which package is the $10,800 price, and how many retest rounds does it include? Copy question
Synack · SynackST	Starts at $10,283; total incomplete: required platform line item not priced here.	Unresolved Patch verification is listed; no count or window is stated.	Which platform tier does this purchase need, and what is the complete price? Copy question
Triaxiom · Web application test	Provider examples: about $12,000 (one role) to closer to $23,000 (multiple roles, many pages).	Unresolved One retest must be completed within 90 days of report delivery; confirm completion timing.	Is our API included in the web application test or quoted separately? Copy question

Intruder's AI web app pentest is white-box and starts with connecting your codebase, so it does not fit a no-source-code brief as published.

Quote-only services and the terms they do publish

These offers show no price for a web app test. An unpublished price says nothing about quality. It does mean the terms below are all you can check before a call.

Table 2. Tests led by people, quote only (A to Z)

Statements about who does the testing are the providers' own. We did not check employment or credentials with anyone else.

Which web app pentest offers deserve a closer look?

Start with the one requirement that would rule an offer out, then look only at the offers that survive it.

Already have a provider, or a test that came with a compliance platform? Put it through the same three questions: how many roles, is the API in, and when does the fix check expire. If it covers your app and the person asking for the report agrees, you do not need to buy another one.

The offers split on your roles, your API and your fix-check date. Write those down once, and every provider answers the same job. Find My PenTest Match walks you through that for a web app and its API and gives you a scope checklist to copy or print. It is free and asks for no contact details. It does not pick a provider for you.

Find My PenTest Match

What should a web application pentest include?

It should cover what an attacker can do without signing in and what a signed-in user can do that they should not. In plain terms:

• Signed-out testing. Everything reachable from the login page and the public site.
• Signed-in testing, per role. What each kind of user can see and change.
• Access control. Whether a viewer can reach a manager's functions, and whether one customer can reach another customer's data.
• Business logic. Misusing a real feature. For example, changing the price in a checkout request, or approving your own refund.
• Input and session handling. Injection, cross-site scripting, and how logins and sessions hold up.
• The API the app talks to.

Many providers name the OWASP Web Security Testing Guide as their method. Its current version, 4.2, includes test categories for authentication, authorization, session management, input validation and business logic. A provider naming the guide tells you the checklist it works from. It does not tell you how much of your app is in the price.

Is the API included, or separate?

It depends on the offer, and the published terms differ. Astra counts the APIs your app uses inside one target. Software Secured sells web and API together. Cobalt says a standard web test covers APIs that serve application content and points deeper API work to a dedicated or combined test. Siemba's starting price requires fewer than five APIs. Triaxiom and Blaze each list API testing as its own service as well.

Ask every provider this: "Which of our API endpoints are inside the quoted price, and which would need a separate test?"

How do user roles change the price?

Roles are the clearest price driver in the published terms. Pentest-Tools.com charges $900 per role. Blaze caps roles by package at 2, 3 and 5. Siemba's starting price stops at 3. Triaxiom's own examples nearly double between one role and many.

Count roles, not accounts. Our example has three roles across two tenants. Testing whether one customer's manager can see the other customer's data takes at least two manager accounts, so a tester may need five or six accounts. That is still three roles. Ask each provider how it counts.

Is retesting included, and how long do you have?

Usually yes, for one round. The deadline matters more than the word "included". Here is each published window as a plain rule.

Four providers publish retest terms that need a closer check. That is not a reason to avoid them. It is a reason to get the term in writing.

• HackerOne. Its retesting article, dated March 24, 2026, says unlimited retests during a remediation period that typically lasts 30 or 90 calendar days, then paid retests with a proposed fee of at least $50 USD while your HackerOne platform service is active. Its pentest FAQ, dated July 17, 2024, says a 60-day window and two retests per report.
• Software Secured. The offer card says 3 rounds. The package table says 1 for Standard, 3 for Standard Plus, unlimited for Premium. The page does not say which package the $10,800 price is.
• Cobalt. The tier table and help docs say 6 or 12 months inside an active contract. The pricing FAQ says "unlimited on-demand retesting throughout your contract term."
• Blaze. Its pricing page makes fix validation a paid add-on for Lite. Its AWS Marketplace listing, also from $4,999, says "Free re-test if performed within 90 days from the final report." These may be different offers. Ask which terms your quote carries.

A contract-end example. Say your Cobalt contract ends November 30, 2026. The retest-request cutoff is 10 days earlier: November 20, 2026. A test that finishes in early November leaves you about two weeks to fix and resubmit, whatever the tier's 6 or 12 months say.

One more word to watch is "re-scan". Astra uses it for a manual check by its testers. Elsewhere it can mean an automated scan. Ask what is rechecked, who does it, and whether you get an updated report.

Send this to any provider on your list: "What date starts our retest window, what is the exact end date, must we request or finish the retest by then, which findings qualify, and what does an extra round cost?"

How much does a web application pentest cost?

Published starting prices for tests led by people run from $3,000 (Siemba, small app) to $10,800 (Software Secured), and Triaxiom's own examples run from about $12,000 to about $23,000. Most providers publish nothing and quote per scope. We are not turning eight data points into a market average.

Three things in the published terms can make a price look lower than it is:

1. A yearly price read as a one-time fee. Astra's $5,999 is per year for one target.
2. A required extra line. Synack's $10,283 is the test. The platform is a separate, required line item, and the page also describes a free Basic Platform. Until Synack says which applies, the total is unknown. Unknown is not zero.
3. A missing fix check. Blaze Lite starts at $4,999 without one. Add the $799 round and it is $5,798, still capped at two roles.

Cobalt's Standard, Premium and Enterprise prices are not published. It sells yearly credits, and one credit is the equivalent of 8 hours across automation and human work, so do not read credits as tester hours.

When you ask for a quote, ask for this: "Please show the total, the currency, the amount due at signing, the billing schedule, tax, what testing and fix checks are included, and the cost of a scope change or an extra retest." If you already hold quotes, the questions to compare offers line them up against the same job.

Is a scan or an AI-led test enough?

It depends on what the person asking for the report will accept, so ask them before you buy. A vulnerability scan is software checking for known problems. A penetration test (pentest) has someone try to break in and show how. An AI-led test automates some or all of that attempt. Several offers below use the word "pentest", so read what each one does.

Buyers worry about this. In one Reddit thread about choosing a web app pentest vendor, the poster asks, "What are some red flags I should watch out for?" The clearest one is a price that buys a scan when your customer expects a person.

Table 3. Tests led by AI (A to Z)

Prescient also lists "Compliance Penetration Testing" starting at $3,000. Its pricing page does not say whether people or its Cacilian tool do that testing, so ask before comparing it with the offers in Table 1.

Intruder promises a full refund if your auditor rejects its report. That is a refund promise. It is not a sign your auditor will accept it.

For any offer, three checks settle it: who runs the first test, what a person reviews, and what your report reader has agreed to accept.

Do you need a web app pentest for PCI DSS or SOC 2?

For PCI DSS, the text calls for application-layer penetration testing. For SOC 2, ask your auditor in writing. In both cases the assessor, auditor or customer decides what they accept, not the provider and not us.

PCI DSS. The PCI Security Standards Council lists v4.0.1 as the current standard. We read the requirement wording in the Council's own Prioritized Approach for PCI DSS v4.0.1, which leaves out the standard's applicability notes. It says:

• Requirement 11.4.1. The penetration testing methodology includes "application-layer penetration testing to identify, at a minimum, the vulnerabilities listed in Requirement 6.2.4." That list covers injection attacks, attacks on business logic and attacks on access control, among others.
• Requirement 11.4.3. External penetration testing is performed "at least once every 12 months" and "after any significant infrastructure or application upgrade or change," by a qualified internal resource or qualified external third party with organizational independence. The tester is "not required to be a QSA or ASV."
• Requirement 11.4.4. Exploitable vulnerabilities are corrected and "penetration testing is repeated to verify the corrections."

That last line is why the retest deadline matters so much to a PCI buyer. If your fixes land after the window closes, the repeat test becomes a new cost. Whether these requirements apply to your app is a question for your QSA.

SOC 2. The AICPA's criteria document sits behind a login and we did not read it, so we will not tell you what it requires. Many providers say their reports are "audit-ready". That is their claim. Your auditor's answer is the one that counts.

Send the person asking for the report this before you book: "Will a report covering these URLs, APIs and roles meet your request? Do you need the full findings or a summary letter, proof that fixes were retested, a particular tester qualification, or testing done by people?" The questions for your report recipient cover the rest.

When you see a sample report, check five things: the scope and dates are named, the method and its limits are stated, each finding has evidence, the fix advice is specific, and the status after retesting is clear.

How long does a web app pentest take?

Published testing times cluster around one to two weeks. Getting on the calendar and getting the report add to that, and providers state those parts differently.

Astra gives "10 to 15 working days" on its help and pricing pages and "10-14 business days" on its web app page. Small gap, same lesson: a stated duration is an estimate, not a reserved date. Ask for your report date in writing.

Before you ask, settle one thing with whoever set your deadline: does it mean the first report, or proof that the fixes were checked? The second needs time for your fixes and a retest on top.

Questions people ask before booking

Do testers need our source code?

Not usually. A black-box test gives testers no inside knowledge. A gray-box test gives them logins and some context, and it is the common choice for a web app. A white-box test adds fuller inside information, sometimes the code. Ask the provider which extra information would improve the test of your app. If you cannot share code, rule out offers that start from it.

Can the test run against our live app?

It can, if you and the provider agree what is allowed. Settle the target, the test data, the actions that are off limits, and who to call to stop the test. A staging copy is the other option. Write down any way it differs from production, because those gaps limit what the results prove.

Do we need a provider near us?

Rarely for a web app. Ask whether anything must happen on site, where the assigned testers work, and whether your contracts restrict tester location or data handling.

Does a scope checklist authorize testing?

No. A checklist or brief is a buying document. NIST's testing guide, SP 800-115, describes rules of engagement as set before a test starts, giving the test team authority for defined activities. Written authorization from the system owner must cover the actual targets and actions. Hosting providers may have their own rules too. Never put passwords or keys in a brief.

How we checked these offers

We read each provider's own pricing, service and help pages on October 8, 2026, applied one example job to the terms we found, and did the arithmetic shown. The service terms in the tables are provider-published. We did not buy these services, test them, or check any provider's credentials with the issuing body. Where a page left something out, we wrote "not stated" instead of guessing.

The PenTest Index does not sell penetration testing. Payment does not decide which offers appear, their order or their findings; tables run A to Z. More on how we check offers and how we make money.

Sources

All checked October 8, 2026.

• Astra: pricing · rescan quota · rescanning vulnerabilities · duration · web app service
• Bishop Fox: application penetration testing
• Blaze: pricing · linked shop · terms, section 2.8 · web service · AWS Marketplace listing
• BreachLock: pricing · home page
• Bugcrowd: pen test as a service · sample web app report
• Cobalt: pricing · retest rules · web methodology
• HackerOne: retesting article · pentest FAQ
• Intruder: pentest pricing
• Kroll: web application penetration testing
• NetSPI: web application testing
• Pentest-Tools.com: managed web app testing · services
• Prescient: pricing · services
• Raxis: web app pentest
• Red Sentry: pentest cost
• Siemba: pricing
• Software Secured: pricing
• Synack: pricing
• TCM Security: web application testing
• Triaxiom: web application penetration test · timing and retest completion
• PCI Security Standards Council: document library · Prioritized Approach for PCI DSS v4.0.1
• OWASP: Web Security Testing Guide
• NIST: SP 800-115