Penetration testing can cost a few thousand dollars for a limited engagement or tens of thousands for broader work. To set a useful budget, you need to know which systems will be tested, how much hands-on investigation is included and what happens after the report arrives.
If you are comparing proposals, a single headline price will only get you so far. An external network test, an internal network test and a detailed assessment of a customer application answer different questions. Even two quotes labelled “penetration testing” can cover very different work.
This guide explains penetration testing cost in Australia using published provider examples, then shows you how to compare scope and budget for the full job. If you already have a requirement from a customer, insurer or procurement team, request a scoped penetration testing quote and explain that requirement in your enquiry.
The budget answer
Start with the business question, then price the testing needed to answer it. Your budget should cover the test, internal preparation, any necessary fixes and verification of those fixes. Employee count alone is a poor basis for estimating the work.
How much does penetration testing cost in Australia?
Published prices provide a starting point, provided you keep the scope beside the dollar figure. The examples below are advertised by other Australian providers. They are not Stanfield IT prices or a measured market average, and the engagements are not directly interchangeable.
| Provider and offer | Published price | Scope and tax treatment |
|---|---|---|
| CyberPro | $2,500–$5,000 | Describes two days of vulnerability and penetration testing plus two days of documentation and reporting. Price varies with the environment. Excludes GST. |
| Cliffside — 3 testing days | $5,900 | Examples include one small web application or a defined external network. Scope confirmed before booking. Excludes GST. |
| Cliffside — 5 testing days | $9,500 | Examples include a combined external/internal test at one site, or a web application and API with multiple roles. Excludes GST. |
| Cliffside — 10 testing days | $18,500 | Examples include broader multi-site or multiple-application work. Scope confirmed before booking. Excludes GST. |
| CyberPulse | Web application: AUD $6,000–$20,000 Internal/network: AUD $10,000–$30,000+ | Indicative ranges in its pricing guide, rather than a quote for a defined engagement. GST treatment is not stated. |
Prices are shown as published by each provider. Confirm current pricing, scope, inclusions and GST treatment in writing. Stanfield IT provides a quote after confirming your testing requirements.
The useful takeaway is the spread of possible work. A small, clearly bounded target may fit within a short engagement. Multiple applications, locations, access levels or connected systems can require a larger budget. Use these examples to start a scoping conversation; do not select a price first and assume it covers your environment.
What changes the price of a penetration test?
1. The systems and access paths in scope
A business with 30 employees and a complex customer portal may need more application testing than a 150-person business with a small internet-facing footprint. Count the targets and explain how they connect: public addresses, domains, applications, APIs, locations, cloud services and identity systems.
State what you want to learn. “Can someone reach sensitive data through our customer portal?” gives a tester a clearer objective than “check our cyber security”. It also makes the proposal easier to assess.
2. Application complexity and user roles
A public website and a portal with customers, staff, administrators, payments and file uploads create different testing workloads. For an application test, include the important workflows and the permissions associated with each role.
For example, you might want testing to examine whether one customer could access another customer’s records. If that is the concern, a proposal covering only the public login page leaves the central question unanswered.
3. The information supplied to the tester
Black-box testing begins with little or no information. Grey-box testing provides some information or access, such as user accounts. White-box testing supplies extensive information, potentially including architecture or source code.
Providing useful access can help a tester spend more time investigating relevant risks. It does not automatically make an engagement cheaper: a broader white-box assessment can still require substantial work. Ask which approach best meets your objective. CREST’s penetration testing guide explains these approaches.
4. Hands-on testing time and operational constraints
Ask for the testing effort as well as the delivery dates. Three tester-days describes effort; a three-week delivery schedule describes elapsed time. Neither tells you, by itself, how much reporting or retesting is included.
Restricted testing windows, multiple sites and production constraints can change the delivery plan. Agree on permitted techniques, exclusions, escalation contacts and stop conditions before work begins. NIST’s assessment guidance includes a rules-of-engagement template for defining those boundaries.
5. The work after testing
Look for a report your team can act on: affected systems, supporting evidence, likely business impact, priority and practical remediation advice. Confirm whether the fee includes a findings discussion and verification after fixes.
Retesting terms matter. For example, Cliffside’s published packages include retesting critical and high findings within 90 days. That is a specific inclusion, not an assumption you should apply to every quote.
Choose the test around the business question
Give each provider the same objective and target list. The following examples can help you describe the work you need.
| Your concern | Scope to discuss | Clarify in the quote |
|---|---|---|
| An attacker entering from the internet | External network testing | Public addresses, remote access services and other exposed targets. |
| A compromised user or device reaching sensitive systems | Internal network and identity testing | The tester’s starting access, locations, identity environment and permitted targets. |
| A customer or outsider accessing another customer’s data | Web application and API testing | Applications, endpoints, user roles and critical business workflows. |
| Weaknesses across cloud services and permissions | Cloud and identity testing, with any configuration review defined separately | Tenants or accounts, services, access provided and the boundary between review and active testing. |
A cloud configuration review and a penetration test are different deliverables. Similarly, a broader audit or risk assessment may answer a different business need. If the requirement is unclear, start with our guide to cyber security audits, risk assessments and penetration tests.
How to compare penetration testing quotes fairly
Put proposals side by side before comparing totals. Check that each one answers the same question, covers the same targets and allows comparable time for investigation.
Ask what manual testing is included
Automated tools are part of professional testing. The distinction is what happens beyond their output. CREST describes penetration testing as combining automated and manual techniques.
Ask how the provider investigates findings and validates their significance within the authorised scope. For an application, ask how it will assess permissions and important business workflows. A long list of scanner results does not tell you that those questions have been investigated.
Check who will perform and review the work
Request relevant experience, current qualifications and an explanation of the quality review process. Ask who will conduct the testing and whether subcontractors are involved. Company accreditation and an individual tester’s certification are separate credentials; verify any claims that matter to your procurement requirements. CREST’s Australian and New Zealand procurement guide provides a useful reference.
See what the report will help you do
Ask for an anonymised sample report. A useful deliverable should explain coverage and limitations, present evidence, prioritise findings and guide remediation. CREST’s defensible testing specification sets out reporting expectations.
Then ask a practical question: could your IT team or developer use this report to start fixing the most important issues? If a customer needs evidence of testing, check what format and level of detail they require before commissioning the work.
Request the exclusions. A quote should make it easy to see what is outside the engagement. Confirm whether APIs, additional roles, production systems, remediation, retesting, travel or after-hours work are excluded or separately priced. An exclusion is manageable when you know about it before booking.
A worked example: same business, different coverage
Imagine a 50-person business with a customer portal, an API and a remote access service. Its main concern is protecting customer records. This is a fictional scoping example, not a Stanfield IT client engagement or price estimate.
Proposal A
External exposure
Covers the agreed public addresses and remote access service. It excludes authenticated portal testing and the API.
What it answers: questions about the defined internet-facing targets. It leaves customer-to-customer access inside the portal untested.
Proposal B
Portal and API
Covers the portal, API and agreed customer and administrator roles. It excludes the internal office network.
What it answers: questions about application access and data handling within that scope. It leaves internal network risks untested.
Both could be valid engagements. They buy different coverage. If protecting customer records is the immediate objective, confirm that the proposal tests the relevant application paths. If you need both scopes, ask for a combined or staged quote with the remaining gaps clearly documented.
Budget for the whole job, including fixes
The testing invoice is one part of the project. A useful budget separates four items:
For preparation, assign someone to confirm ownership of targets, arrange authorised access, supply test accounts and coordinate with your IT provider or developers. Agree on how sensitive data and results will be handled.
For remediation, identify who can make changes and reserve time for them. A configuration change, software update and application code fix can require different people and budgets. Ask how support will be charged rather than assuming fixes are included in the testing fee.
For retesting, confirm which findings are covered, the booking deadline, the time allowance, the number of rounds and the updated evidence you will receive. Verification of selected fixes is a narrower task than a new test of the entire environment.
There is no useful universal percentage to add for remediation before you know the findings. Record the assumptions, identify who approves additional work and ask for itemised costs where they can be established. For the surrounding security programme, see our Australian cyber security services cost guide.
A checklist to send with your quote request
Use the same checklist with each provider. It gives you a consistent basis for comparing proposals and reduces the chance of discovering a scope gap after testing starts.
- Objective: the business question, customer requirement or decision the test needs to support.
- Targets: the applications, APIs, addresses, locations, cloud services and identity systems to include.
- Access: test accounts, roles, architecture information and any access restrictions.
- Coverage: manual investigation, testing effort, methodology, exclusions and operating constraints.
- Delivery: testing window, report date, named contacts and findings discussion.
- Commercials: GST, assumptions, optional work, change charges and payment terms.
- Follow-through: responsibility for fixes, retest coverage, deadlines and updated reporting.
- Assurance: tester experience, quality review and secure handling of credentials, evidence and reports.
Download the quote comparison checklist
CSV spreadsheet with fields for your requirements and two provider proposals. No form required.
Penetration testing cost: frequently asked questions
How much should a small business budget?
Use the published examples above as an initial reference, then request a quote against a defined target list. A small headcount does not necessarily mean a small testing scope. Applications, access levels, integrations and the questions you need answered are more useful inputs than employee numbers alone.
Is a vulnerability scan the same as a penetration test?
No. A scan helps identify potential weaknesses. A penetration test adds investigation and validation within an agreed scope. They can complement each other. For ongoing discovery and follow-up between tests, consider vulnerability management.
How long does a penetration test take?
The scope determines the effort. Confirm tester-days separately from calendar dates, and ask whether preparation, reporting and retesting sit inside or outside that allowance. Also leave time for your team to supply access, review findings and complete any fixes before an external deadline.
Does the fee include remediation and retesting?
Only if the proposal says so. Remediation is the work to fix findings; retesting checks the agreed fixes. Ask for both to be described separately, including any limits or additional charges. An included retest may cover selected severities or a limited period.
How often should we arrange testing?
Plan around your risks, significant changes and any specific contractual or assurance requirements. A major application release or infrastructure change may justify another assessment. Ask what interval suits your environment and what should trigger an earlier review.
Will a clean report prove our business is secure?
No. A test examines an agreed scope during a particular period. It cannot establish that every system is free from weaknesses or guarantee future security. NIST describes security assessments as a snapshot. Use the findings alongside ongoing security maintenance and monitoring.
Plan your next test
Get a quote with the scope clearly defined
Stanfield IT can help you scope penetration testing across external and internal networks, applications, cloud and identity systems, with reporting and support for the next steps.
Tell us what prompted the test, which systems are involved and when you need the results. We can clarify the coverage, deliverables and options for remediation support and retesting before quoting.
