We checked and found no price on the pricing pages of BreachLock, HackerOne, Bishop Fox, Emagined Security and Red Sentry. All route to a sales conversation.
Red Sentry states its position openly: "No packages. No bait pricing. No arbitrary numbers." Source: Red Sentry, 17 August 2026.
Rhino Security Labs gives one directional figure and no list: "Penetration testing generally start around the $10,000 range, but can grow into six figures for large, in-depth projects." Source: Rhino Security Labs FAQ, no date shown.
Raxis describes the spread it sees in the market rather than its own price: "I know something is amiss when I see quotes range from $1,500 to $18,000 per week (and more)." Source: Raxis, content updated 16 June 2025.
Price ranges by scope
Two US firms publish a dated range table. We print both, because they disagree in places and you should see that.
Synack, dated 25 June 2026
| Scope |
Published range |
| External network |
$4,000 – $12,000 |
| Web application |
$5,000 – $30,000 |
| API |
$5,000 – $30,000 |
| Internal network |
$5,000 – $35,000 |
| Mobile application |
$7,000 – $35,000 |
| Cloud |
$10,000 – $50,000 |
| Red team / adversary simulation |
$30,000 – $150,000+ |
Headline from the same page: "Penetration testing costs in 2026 range from $5,000 to over $100,000, with most organizations spending between $10,000 and $30,000 per engagement and an all-types average of around $18,300." Source: Synack pentest cost guide, 25 June 2026.
Compass IT Compliance, dated 3 June 2025
This table breaks the price by size rather than by type, which is closer to how a quote is actually built.
| Scope |
Published range |
| External network, 1–25 IPs |
$5,000 – $10,000 |
| External network, 25–50 IPs |
$10,000 – $15,000 |
| External network, 50–100+ IPs |
$15,000 – $30,000+ |
| Internal network, 1–2 VLANs |
$7,500 – $12,000 |
| Internal network, 3–5 VLANs, 100–300 devices |
$12,000 – $20,000 |
| Internal network, 300+ devices |
$20,000 – $40,000+ |
| Web app, simple static, 1–5 pages |
$3,500 – $6,000 |
| Web app, moderate dynamic |
$8,000 – $15,000 |
| Web app, complex custom |
$15,000 – $35,000+ |
| API |
$6,000 – $18,000 |
| Cloud |
$10,000 – $25,000 |
| Mobile |
$10,000 – $22,000 |
| Red team, foundational, 2–4 weeks |
$40,000 – $65,000 |
| Red team, advanced, 6–8+ weeks |
$70,000 – $120,000+ |
| PCI DSS pentest |
$12,000 – $25,000 |
| Consulting, hourly |
$250 – $400 per hour |
Source: Compass IT Compliance, 3 June 2025.
One more dated point for external testing
Triaxiom Security publishes external network figures on a page dated 3 April 2026: about $5,000 for fewer than 10 hosts, $8,000 to $15,000 for 10 to 50 hosts, and $15,000 to $20,000 or more above 50 hosts. It also names the driver: "Scope (specifically, the number of IP addresses on your Internet perimeter with at least one open port accepting connections) is the biggest single cost driver." Source: Triaxiom Security, 3 April 2026.
Triaxiom's internal and web application price pages are dated 2018. We left those figures out.
A market benchmark
Packetlabs states that "the average cost of a penetration test in the United States in 2025 ranges from $10,000 to over $150,000". Source: Packetlabs, published 20 January 2024, last updated 20 October 2025. Packetlabs is a Toronto firm writing about the US market in USD.
Which US rules actually require a penetration test
Buyers get sold on the wrong requirement all the time. Here is what the text says.
PCI DSS v4.0 requires one, twice a year in effect
Requirement 11.4.2 covers internal testing and 11.4.3 covers external testing. Both use the same wording: testing is performed "Per the entity's defined methodology", "At least once every 12 months", "After any significant infrastructure or application upgrade or change", "By a qualified internal resource or qualified external third-party", and "Organizational independence of the tester exists".
Requirement 11.4.5 adds segmentation testing at least once every 12 months. Requirement 11.4.4 says exploitable findings must be corrected and "Penetration testing is repeated to verify the corrections".
Source: PCI SSC, PCI DSS v4.0 SAQ D for Merchants, publication date April 2022.
Note what PCI does not say. It names no tester certification at all. Not OSCP, not CREST, not GPEN. It asks for a qualified party and for organizational independence. Your QSA decides what qualified means.
CMMC Level 3 requires an annual penetration test
The regulation says it directly: "Conduct penetration testing at least annually or when significant security changes are made to the system". Source: 32 CFR 170.14.
CMMC Level 1 has no penetration testing requirement. Level 2, built on NIST SP 800-171, does not name penetration testing.
NYDFS Part 500 requires an annual penetration test
Section 500.5(a)(1) requires "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually". Source: NYDFS Second Amendment to 23 NYCRR 500, dated 1 November 2023. The Section 500.5 compliance date was 1 May 2025.
Again, the rule asks for "a qualified internal or external party" and names no certification.
FedRAMP requires one, and it must be a 3PAO
FedRAMP publishes dedicated penetration test guidance for cloud service providers. Source: FedRAMP Penetration Test Guidance version 3, dated 30 June 2022. The assessment must come from an accredited third-party assessment organization.
We could not source an "at least annually" cadence from a fedramp.gov page. The FedRAMP Rev5 control CA-08 leaves the frequency as an organization-defined parameter. We are not going to print a cadence we cannot cite.
HIPAA does not require a penetration test
The Security Rule requires "a periodic technical and nontechnical evaluation" of security measures. Source: 45 CFR 164.308(a)(8). The word "penetration" does not appear in that section.
A proposed HHS rule would add a 12-month penetration testing requirement. It is not in force. Do not let a vendor tell you HIPAA mandates a pentest today.
SOC 2 does not require a penetration test
The AICPA Trust Services Criteria do not name penetration testing. Auditors commonly accept a pentest report as evidence for CC4.1 and CC7.1, and enterprise buyers commonly ask for one, but the framework itself does not mandate it. Read your auditor's request list, not a vendor's blog.
Accreditation in the US
There is no US equivalent of the UK CHECK scheme for general commercial work.
The closest thing is FedRAMP 3PAO accreditation, and it applies only to federal cloud work. 3PAOs are accredited by A2LA against ISO/IEC 17020 and the A2LA R311 requirements. Source: A2LA FedRAMP accreditation.
OSCP, GIAC GPEN and CREST are market signals in the United States. No US regulation we checked names any of them. CREST does operate an Americas chapter and some US firms hold it. Source: CREST.
What we could not source
- No US vendor publishes a day rate. Not one. Hourly figures of $200 to $400 appear in vendor blog posts only, never on a pricing page.
- Cobalt's State of Pentesting report carries no cost data. We checked. Eight editions, no dollar figures.
- BreachLock publishes no price. Per-service figures circulating online come from a third-party buyer-data site, not from BreachLock. We did not print them.
- Bishop Fox publishes nothing. The page that reportedly carried a range now returns a 404.
- We could not fetch the PCI DSS v4.0.1 master document. It sits behind a click-through licence. We cited the Council's own SAQ D, which carries the same requirement text.
- We could not source the FedRAMP annual cadence from an official page.
- We could not deep-link a proof that SOC 2 omits penetration testing. Absence is hard to cite. Check the Trust Services Criteria yourself.
Where Matproof Sentinel fits, and where it does not
Matproof Sentinel is an AI penetration testing platform. Pricing is public, in euros, with no sales call: €149 per single run, €299 per month, €1,490 per month, and Custom for enterprise. See pricing. We do not publish a USD price list.
Sentinel runs ten specialised AI agents in stages. Recon maps the surface with nmap, amass and httpx. Web, API, Infra, Cloud and Mobile agents run in parallel with nuclei, sqlmap, OWASP ZAP, testssl.sh, Prowler and MobSF. Source-code and supply-chain agents read your repositories with Semgrep, Gitleaks and Trivy. A ValidatorAgent re-runs every finding and stamps it VALIDATED, UNVERIFIED or FALSE_POSITIVE. Reports export as PDF, JSON and SARIF 2.1.0. The full method is public at docs.matproof.com.
What Sentinel is not
- There is no human penetration tester. AI agents find the issues. Another AI agent checks them.
- Matproof holds no CREST accreditation, no NCSC CHECK approval and no FedRAMP 3PAO accreditation.
- Sentinel does no social engineering, no physical intrusion and no zero-day research.
- Sentinel cannot sign a report as an accredited assessor.
On PCI DSS specifically
PCI DSS 11.4 asks for a qualified party and organizational independence. It names no certification, and an independent platform can satisfy the independence part. Whether your QSA accepts an AI-only test as the 11.4 penetration test is your QSA's call, not ours. Ask your QSA before you rely on it. We will not tell you it is settled.
Hire a US firm instead when
- You are in a FedRAMP process. You need a 3PAO.
- A customer contract or a federal tender names an accreditation.
- You need social engineering, physical entry or a full red team.
- Your QSA has told you an AI-only test will not satisfy 11.4.
- You run OT, SCADA or mainframe systems.
Use Sentinel when
- You ship code weekly and an annual test leaves the rest of the year untested.
- Your auditor wants evidence that testing ran all year, not once.
- You want a price without a sales call.
- You want findings in your issue tracker and SARIF in your pipeline, not a PDF in a shared drive.
Most mature teams do both. One accredited engagement a year for the signature. Continuous automated testing for the evidence in between.
Frequently asked questions
How much does a penetration test cost in the US?
Synack's dated guide puts most engagements at $10,000 to $30,000, with an all-types average near $18,300 (25 June 2026). Compass IT Compliance breaks it down by size, from $3,500 for a simple static web app to $40,000 or more for a large internal network (3 June 2025). Published vendor prices start at $1,999 per year for Astra and $3,500 per autonomous test at Cobalt.
What is the hourly rate for a US penetration tester?
Two vendor blogs publish a figure: $250 to $400 per hour (Compass IT Compliance, June 2025) and $200 to $400 per hour (Software Secured, no date shown). No US vendor pricing page publishes a rate.
Does PCI DSS require a penetration test?
Yes. Requirements 11.4.2 and 11.4.3 require internal and external testing at least once every 12 months and after significant change, plus segmentation testing under 11.4.5 and a re-test to verify fixes under 11.4.4.
Does SOC 2 require a penetration test?
No. The Trust Services Criteria do not name it. Auditors and customers usually ask for one anyway, and it is commonly mapped to CC4.1 and CC7.1.
Does HIPAA require a penetration test?
Not today. 45 CFR 164.308(a)(8) requires a periodic evaluation and never uses the word penetration. A proposed HHS rule would change that. It is not in force.
Do I need an OSCP or CREST certified tester in the US?
No US rule we checked names a certification. PCI DSS asks for a qualified party with organizational independence. NYDFS asks for a qualified internal or external party. Certifications are how firms signal quality, not how regulators define it.
Related reading
Ready to act on this? Matproof runs continuous AI penetration testing with public pricing. Book a demo.