The right question is not the price
When a company looks for a penetration test, the first question is almost always:
“how much does it cost?”
It's normal.
But often, it's also the wrong question.
The point is not the price.
The point is understanding what you are actually buying.
Not all penetration tests are equal
A serious penetration test is not a simple automated scan.
We are talking about real analysis of:
The level of depth completely changes the value.
What determines the cost
It depends on:
A test for an SMB and one for an enterprise entity are not comparable.
The risk of a price that's too low
Many choose the cheapest test.
Often this means:
And in the end, the problem remains.
The real cost
The real cost is not the penetration test.
It is not doing it.
An undiscovered vulnerability can cost much more than any preventive assessment.
When to do it
Not just “when something happens.”
Conclusion
The correct question is not:
“how much does a penetration test cost?”
but:
“how much does it cost not to know where you are vulnerable?”