How Much Does an External Penetration Test Cost?

An external penetration test at azpentest costs from $4,000, with the retest included and the price fixed once the scope is agreed in writing. That is our Small External tier, and it is where most small businesses start. This guide is for the owner who has been asked for an external test by an insurer, a client, or a payment processor, and wants to know how much an external penetration test costs before the sales call, what moves the number, and what to send over to get a firm quote.

What an external penetration test covers

An external penetration test looks at your business from the internet, the same place an outsider sits, before anyone is inside. The tester maps what you actually expose: your firewall, your VPN or remote access, email, your website and any customer or staff login, and the odd forgotten thing, like a staging server someone spun up and never took down. Then they test each piece by hand as well as with tooling, and write up what an outsider could actually reach, what they could get through, and what to fix first. The full engagement is on our external penetration testing service page. This post is about the price.

External penetration testing pricing

Here is our published pricing. The external test is the first row.

If you are testing	Where pricing starts
Your internet-facing setup only (external)	from $4,000
External plus your internal network	from $6,500
External, internal, web app, and phishing	from $10,000

Retests are included on every tier. Once you fix what we find, we check the fixes at no extra charge, and the report shows each item as tested, fixed, and retested. The quote is fixed against a written scope, so there is no hourly meter and no surprise line at the end. Full detail is on the pricing page.

How much an external penetration test costs across the market

Published cost guides put external tests between about $5,000 and $20,000. BrightDefense, for one, gives that range and ties it to the number of external assets, the complexity of the environment, and the depth of testing. Those figures cover everyone from a dental office to a bank, so the top of the range says little about what a 30-person Arizona business should budget. Our starting price sits below the bottom of it, for manual and automated testing by a real person, and we publish it so you can budget before the conversation instead of during it. The wider picture, internal and web app included, is in how much does a penetration test cost.

Why we don’t price per IP address

Some firms quote external tests by the number of IP addresses in scope, the numbered addresses your internet connection and hosted services answer on. That is a tidy shortcut for a large network, but for a small business it measures the wrong thing. Many small businesses have only a handful of addresses. One of them can sit in front of a remote-access portal, a mail server, and a customer login, which is real testing work, while another answers nothing at all. So we scope by what is actually reachable from the internet and what it does, then quote a fixed price for that. You never have to count your addresses to get a number.

What moves the external price

When an external quote goes above the starting number, it is built from a few honest factors:

How much you actually expose. More internet-facing systems and services means more skilled hours. A firewall, a VPN, email, and a simple website is a smaller job than several customer portals and cloud services spread across providers.
More than one location or domain. Each office with its own internet connection, and each brand or acquired company with its own domain, adds surface to map and test.
Custom web applications. The external test checks your website and login pages the way an outsider meets them: what is exposed, whether it is patched, how it is configured. If you run a custom app with customer accounts and want the logged-in side tested, such as whether one customer can see another’s records, that is web application penetration testing, a separate scope. It is included in the $10,000 tier or quoted on its own.
Compliance format. If the report has to satisfy a specific requirement, such as PCI for an online store, an insurer’s attestation, or a client’s security questionnaire, that shapes the write-up and sometimes the method.

Notice what is not on the list: having a VPN, a firewall, a mail server, or a remote-access portal. Those are supposed to be on the internet. They do not raise your price and they are not findings. The test checks whether they are patched, configured right, and behind multi-factor login.

External alone, or external plus internal?

For a lot of businesses, the external test is the whole job. External alone is usually the right test when:

your insurance questionnaire asks about testing your internet-facing systems, or asks for external testing by name
you take cards through an online store where your own page is part of the payment flow (PCI SAQ A-EP), which calls for an external test only; our PCI guide has the full breakdown
a client asked for proof that your internet-facing systems were tested
it is your first test and you want to start with the door the whole world can see

Step up to external plus internal, from $6,500, when the questionnaire or contract names internal testing, when you store or directly handle card data (SAQ D), or when you want to know what happens after one phished laptop lets someone in. We sell the internal half bundled with external rather than on its own, and how much does an internal penetration test cost explains why. If you are not sure which test your insurer means, send us the exact wording and we will tell you plainly. We would rather sell you the $4,000 test you need than the $6,500 one you don’t.

Why a cheap external quote is usually a scan

An external vulnerability scan is an automated tool pointed at your internet-facing systems. It checks them against a catalog of known weaknesses and produces a list, and it is genuinely useful. Many merchants owe a quarterly one under PCI, called an ASV scan, and owing the scan does not mean owing a test. The trouble starts when a scan is sold as a penetration test. NIST’s technical guide to security testing treats them as separate techniques: scanning identifies possible weaknesses, and a penetration test has a person confirm which ones are real and whether they can be strung together. Those are different results at different prices.

If an external quote comes in at a few hundred dollars, ask three questions:

Will a named person test by hand, or will a tool run and generate the report?
Will they try to chain small issues together, like a password leaked in an old breach that still works on your remote-access login?
Is a retest of your fixes included, and what does the report look like? Our walkthrough of what a penetration test report looks like shows what a useful one contains.

If the honest answer is a scan, it may still be worth buying as a scan. It just may not hold up if an insurer or a client looks closely at a “penetration test” line on your paperwork. The longer version is in penetration test vs vulnerability scan.

What to send for an external penetration testing quote

The fastest route to a firm number is a short note with five things. You don’t need a network diagram or a perfect asset list. Finding what is actually exposed is part of the test, and it is often more than the list says.

Your domain names, including old brands and any company you have bought.
What you know faces the internet: remote access or VPN, email, your website, client portals, anything a provider hosts for you.
What is prompting the test, with the exact wording if an insurer or a client sent a questionnaire.
Your deadline, such as an insurance renewal date or a contract start.
Who hosts what. If a provider runs your website or portal, we confirm during scoping that you can authorize testing it, and it goes in the written scope.

We come back with a fixed quote in writing within two business days, and testing usually starts within two weeks. The test runs remotely, so nobody comes on-site and nothing gets installed. Most external engagements take about one to two weeks from scoping to report, and we agree a testing window and a contact up front so your IT provider is not surprised by the traffic. How to prepare for a penetration test covers the rest, and it is short.

FAQ

How much does an external penetration test cost for a small business?

At azpentest, an external penetration test starts at $4,000 with the retest included, and the price is fixed once the scope is agreed in writing. Across the wider market, published guides put external tests between about $5,000 and $20,000. What moves any quote, ours included, is how much you actually expose to the internet.

Do you price external penetration tests per IP address?

No. Some firms quote by IP count, but the count says little about the work. One address can sit in front of a remote-access portal, a mail server, and a customer login, while another answers nothing at all. We scope by what is actually reachable from the internet and quote a fixed price for it.

Is an external vulnerability scan the same as an external penetration test?

No. A scan is an automated tool checking your internet-facing systems for known weaknesses. It is useful, and PCI requires quarterly scans for many merchants. A penetration test adds a person who confirms what is real, tries to chain small issues together, and ranks what to fix first. A very cheap external quote is usually a scan.

What do you need from me to quote an external penetration test?

Your domain names, a rough list of what you know faces the internet, what is prompting the test, and any deadline, such as an insurance renewal date. If an insurer or a client sent a questionnaire, send the exact wording. We come back with a fixed quote in writing within two business days.

Where to start

If an external test is on your list, the answer to how much an external penetration test costs at azpentest is from $4,000, fixed once the scope is agreed, with the retest included. See the full pricing for the other tiers, or tell us a little about your business and what is prompting the test, and we will come back with a fair, fixed quote. Request a quote. No pressure, no scare tactics.