How much does a penetration test cost?

Dex Security publishes transparent starting prices: external testing starts at $4,000, a full external-plus-internal test starts at $6,500, and a full-scope engagement (external, internal, web app, and phishing) starts at $10,000. The final number depends on the size of your environment and what is in scope. A retest of fixed findings is included in every tier.

Is this an automated scan or a real manual penetration test?

Both. Every engagement is an automated pass plus hands-on manual testing by a human. Manual testing is where the chained, real-world attack paths get found, the ones an automated scanner alone will miss.

Is a retest included after we fix the findings?

Yes. Every tier includes a retest of your fixed findings, 30 days on the smaller tiers and 60 days on the enterprise tier. You should not have to pay twice to confirm a fix actually worked.

Will this satisfy our cyber-insurance requirement?

Yes. The assessment produces a clean, dated penetration test report that answers what carriers ask on their questionnaires, plus a prioritized fix list so you can close gaps before renewal.

How does the monthly vs annual billing option work?

Monthly retainers provide month-to-month flexibility with continuous monitoring and regular assessment windows. Choosing an annual commitment gives you a 20% discount across all tiers.

PRICING

Penetration testing pricing, published up front.

Most firms make you sit through a sales call just to learn the price. We would rather tell you up front. Here is what ours start at, and what moves the number. Rates are flat and scoped in writing, with no hourly meter, so think of these as fair starting points and the quote you get back as final.

Small External Pentest

from $4,000USD / month

External, internet-facing testing

Authenticated and unauthenticated testing of public-facing services
A written report ranking every finding by exploitability
30-day retest of fixed findings, included

Best for: Single-location SMBs and first-time or compliance-driven tests

Request a quote

MOST COMMON

Medium Full Pentest

from $6,500USD / month

External plus internal network testing

Everything in Small, plus testing from inside the network
Active Directory enumeration and privilege-escalation testing
Executive summary, technical findings, and a remediation roadmap
30-day retest of fixed findings, included

Best for: HIPAA or PCI scoped environments and repeat clients

Request a quote

Large Enterprise Pentest

from $10,000USD / month

Full scope: external, internal, web app, and phishing

Web application testing and a phishing simulation
Active Directory enumeration with lateral-movement testing
An executive briefing call to walk leadership through the results
60-day retest of fixed findings, included

Best for: Multi-location businesses and SOC 2 audit prep

Request a quote

Every tier includes a retest of your fixed findings. That is built in, not an upsell.

What moves the price

No two networks are the same, so no two quotes are either. A handful of things decide where you land:

The size and complexity of your environment, which we scope with you up front.
Whether we are testing web applications, not just network services.
Whether you want attack surface monitoring between manual tests.
Internal testing, from inside the network, on top of the external view.

Why we charge what we charge

Most teams pay $10,000 or more per test, and a lot of the time that is an automated scan with a logo on the report. Real attackers do not just run a scanner and call it a day, so neither do we. Every engagement is the automated pass plus real hands-on manual testing, the kind that finds the chain of small problems that actually gets someone in.

And the retest is included. Once you have fixed what we found, we check your work. You should not have to pay twice to find out the fix worked.

Engagement Comparison

One-Time Assessment vs. Monthly Security Review

Why recurring assessments provide sustainable security coverage compared to annual audits.

Assessment Factor	One-Time Assessment	Monthly Security Review (PTaaS)
Evaluation Model	Point-in-time evaluation	Recurring scheduled evaluation
Findings Delivery	Initial findings report only	Periodic findings, tracking & monthly updates
Assessment Scope	Defined project scope	Defined ongoing assessment scope with change detection
Remediation Retesting	Optional add-on or single retest	Included retesting of fixed findings each month
Relationship Model	One-time transactional engagement	Dedicated recurring partnership on a fixed fee

Common questions

How much does a penetration test cost?: Dex Security publishes transparent starting prices: external testing starts at $4,000, a full external-plus-internal test starts at $6,500, and a full-scope engagement (external, internal, web app, and phishing) starts at $10,000. The final number depends on the size of your environment and what is in scope. A retest of fixed findings is included in every tier.
Is this an automated scan or a real manual penetration test?: Both. Every engagement is an automated pass plus hands-on manual testing by a human. Manual testing is where the chained, real-world attack paths get found, the ones an automated scanner alone will miss.
Is a retest included after we fix the findings?: Yes. Every tier includes a retest of your fixed findings, 30 days on the smaller tiers and 60 days on the enterprise tier. You should not have to pay twice to confirm a fix actually worked.
Will this satisfy our cyber-insurance requirement?: Yes. The assessment produces a clean, dated penetration test report that answers what carriers ask on their questionnaires, plus a prioritized fix list so you can close gaps before renewal.
How does the monthly vs annual billing option work?: Monthly retainers provide month-to-month flexibility with continuous monitoring and regular assessment windows. Choosing an annual commitment gives you a 20% discount across all tiers.

PREDICTABLE MONTHLY RETAINERS

Make Security Reviews Part of Your Ongoing Operations

Discuss a recurring assessment plan tailored to your business, applications, and compliance requirements. No surprise invoices, no hourly meters.

Request a Security Consultation →