VAPT Cost in 2026: What a $3,000 vs $30,000 Pentest Buys You
Penetration testing costs $5,000 to over $100,000 per engagement in 2026. Most organizations spend $10,000 to $30,000, and the all-types average is about $18,300. The gap between a cheap quote and an expensive one is rarely profit. It is usually how much work a human tester does.
VAPT stands for vulnerability assessment and penetration testing. The vulnerability assessment is a scan that lists known weaknesses. The penetration test is a person trying to exploit them, the way an attacker would. You need both, because a scan can't tell you which flaws an attacker can use.
Penetration Testing Cost by Asset
Web Application Pentest Cost
A web application test typically costs $5,000 to $30,000. The price rises with the number of user roles, pages, integrations and business logic to test. A simple brochure site sits at the low end. A customer portal with payments sits near the top. Fix the basics first with our website security best practices, so testers spend their hours on the hard flaws.
Network and Cloud Pentest Cost
An external or internal network test runs $5,000 to $40,000. A cloud test (AWS, Azure or GCP) runs $10,000 to $50,000, because testers must review identity settings, storage access and misconfigurations across many services. Our cloud security best practices cover the settings testers check first.
Mobile App and API Pentest Cost
API testing costs $6,000 to $30,000. A mobile app test costs $7,000 to $35,000 per platform, so iOS and Android together can nearly double the bill.
In India, a full penetration testing engagement typically costs ₹2 lakh to ₹8 lakh, and a vulnerability scan alone costs ₹25,000 to ₹1 lakh.
Automated Scan vs Manual Pentest: Which One Is Worth Paying For?
Automated tests are cheaper but less detailed. Manual testing costs more and goes deeper. Hybrid testing sits in the middle and is the best value for most companies. Some vendors sell automated web app tests from about $3,000 a year, which is useful for frequent checks. It is not a substitute for a manual test before an audit or a major release.
A useful rule: automate the routine checks every month, and pay for a human tester when the stakes are high.
Our guide to automated vs manual testing shows how to split the work test by test.
Fixed Price, Day Rate or Subscription: How Pentests Are Priced
The pricing model changes your penetration testing cost as much as the scope does.
- Fixed price: one price for one written scope. Most fixed-price VAPT projects cost $3,000 to $20,000+. This suits teams that need a predictable budget.
- Day rate: you pay per tester day. It is common for red team work, where UK rate cards run £980 to £1,600 per day. Watch for scope creep.
- Subscription (PTaaS): penetration testing as a service carries a higher sticker price than one test. In return, it covers retests, continuous checks and more of your attack surface. It suits teams that ship code every week.
How Often Should You Run VAPT?
Run VAPT at least once a year, and again after any major change. PCI DSS guidance and the FTC Safeguards Rule both point to an annual test. Many teams also test after a new product launch, a cloud migration or a large code release. If you ship software every week, a yearly test leaves long blind spots, which is why continuous testing programs exist. Our guide to security testing in the software development lifecycle shows how to build checks into every release.
Small businesses (up to 150 staff) typically budget $8,000 to $20,000 a year for penetration testing. Mid-market firms budget $20,000 to $50,000, and enterprises $50,000 to $150,000+.
