Pricing
What a penetration test actually costs.
Most firms make you sit through a sales call just to learn the price. We would rather tell you up front. Here is what ours start at, and what moves the number. The honest answer to "what will it cost" is "it depends on what we are testing," so think of these as fair starting points, not a final quote.
Small External Pentest
from $4,000
External, internet-facing testing
- Authenticated and unauthenticated testing of public-facing services
- A written report ranking every finding by exploitability
- 30-day retest of fixed findings, included
Best for: Single-location SMBs and first-time or compliance-driven tests
Request a quoteMedium Full Pentest
from $6,500
External plus internal network testing
- Everything in Small, plus testing from inside the network
- Active Directory enumeration and privilege-escalation testing
- Executive summary, technical findings, and a remediation roadmap
- 30-day retest of fixed findings, included
Best for: HIPAA or PCI scoped environments and repeat clients
Request a quoteLarge Enterprise Pentest
from $10,000
Full scope: external, internal, web app, and phishing
- Web application testing and a phishing simulation
- Active Directory enumeration with lateral-movement testing
- An executive briefing call to walk leadership through the results
- 60-day retest of fixed findings, included
Best for: Multi-location businesses and SOC 2 audit prep
Request a quoteEvery tier includes a retest of your fixed findings. That is built in, not an upsell.
What moves the price
No two networks are the same, so no two quotes are either. A handful of things decide where you land:
- The size and complexity of your environment, which we scope with you up front.
- Whether we are testing web applications, not just network services.
- Whether you want a phishing simulation included.
- Internal testing, from inside the network, on top of the external view.
Why we charge what we charge
Most teams pay $10,000 or more per test, and a lot of the time that is an automated scan with a logo on the report. Real attackers do not just run a scanner and call it a day, so neither do we. Every engagement is the automated pass plus real hands-on manual testing, the kind that finds the chain of small problems that actually gets someone in.
And the retest is included. Once you have fixed what we found, we check your work. You should not have to pay twice to find out the fix worked.
Common questions
- How much does a penetration test cost in Arizona?
- AZ Pentest publishes transparent starting prices: external testing starts at $4,000, a full external-plus-internal test starts at $6,500, and a full-scope engagement (external, internal, web app, and phishing) starts at $10,000. The final number depends on the size of your environment and what is in scope. A retest of fixed findings is included in every tier.
- Is this an automated scan or a real manual penetration test?
- Both. Every engagement is an automated pass plus hands-on manual testing by a human. Manual testing is where the chained, real-world attack paths get found, the ones an automated scanner alone will miss.
- Is a retest included after we fix the findings?
- Yes. Every tier includes a retest of your fixed findings, 30 days on the smaller tiers and 60 days on the enterprise tier. You should not have to pay twice to confirm a fix actually worked.
- Will this satisfy our cyber-insurance requirement?
- Yes. The Cyber-Insurance Readiness engagement produces a clean, dated penetration test report that answers what carriers ask on their questionnaires, plus a prioritized fix list so you can close gaps before renewal.
- What areas of Arizona do you serve?
- AZ Pentest serves businesses across Arizona, including Phoenix, Tucson, Scottsdale, Mesa, Tempe, Chandler, Gilbert, Glendale, Peoria, and Flagstaff. Testing is performed remotely or on-site depending on scope.
Not sure which tier fits?
Tell us a little about your network and what is prompting the test. We will figure out the right scope with you and come back with a fair, fixed quote. No pressure, no sales theater.