M37

What a penetration test costs, and what the report contains

This is the material behind the video. Every figure below comes from a document anyone can open, and every row links to the document it came from. Nothing here is an estimate of ours, an average we computed from somebody else’s average, or a number a vendor gave us in private.

Harvested 2026-09-01.

The numbers in the video

How this was put together

Three public records, kept separate because they are not the same kind of number. Sellers' own published prices, most of which exist because the UK government makes publishing one a condition of being listed on its buying framework. Awarded US federal contracts, read one description at a time: a keyword search returned 1,795 and only 157 survived reading, the rest being training courses, software licences, military red teams, soil tests and, in four cases, viral penetration tests on medical gowns. And penetration-test reports the firms published themselves, parsed for what each one contains. Every row links to the document it came from.

What these numbers cannot tell you

• A published price is an asking price. An awarded contract total is what was obligated on a whole agreement. A schedule labour rate is a ceiling, not what anyone was paid. None of the three is the price of one test, and averaging across them would be meaningless.
• The UK prices are framework prices: what a supplier is willing to have a public-sector buyer see before negotiating. There is no reason to assume a private buyer is quoted the same.
• Only five vendors publish a fixed per-test price. That median moved 40% when the fifth was added, so read the spread and not the midpoint.
• 42 bundled awards were caught by their own descriptions. An unknown number were not, and that error pushes the top of the range up rather than down.
• The reports are the ones firms chose to publish, almost always for open-source, grant-funded or crypto clients and at narrower scope than commercial work, and Trail of Bits is about 60% of the corpus. They support claims about what a published report contains and nothing about the typical private engagement.
• Severity words are not comparable between firms. Trail of Bits and iSEC Partners print no Critical tier at all; X41 print no Informational tier; Radically Open Security use a different ladder entirely. Counting 'criticals' across firms measures vocabulary.

What we could not get

• The G-Cloud service catalogue. buyer browse moved behind a login, so these documents are the search-indexed subset rather than the framework's full population. This is the biggest limit on the seller-price side.
• BreachLock, Probely, ImmuniWeb pricing. 403 to a plain request, or prices rendered by client-side script. Reachable with a browser; not escalated.
• Award line items. there is one free-text description per federal award and no line items published anywhere, which is why a bundle can only be caught when its own description happens to enumerate.
• 155 reports from 74 further firms. fetched, but with no machine-readable findings summary to parse. Doyensec, ConsenSys, Hacken, Securitum, Quarkslab and Bishop Fox are the largest losses.
• A price and a report for the same job. does not exist in public anywhere we could find, which is why this page cannot tell you whether price predicts what you get.

What it cost, where a record says so

217 rows. You can sort by any column heading, and the box below narrows the table to rows containing a word you type. Opening a row shows the scope in the record’s own words, and the document it came from.

What the reports contain

501 reports the firms published themselves. Severity words are not comparable between firms, so each row carries the ladder its own firm used. Open the row to see it.

Ask us to run something

If you want this rerun against your own market, your own corpus of reports, or a record your organisation keeps, say so here. We read everything and we answer, including when the answer is no. If we take something on, the protocol is written down before the run starts and published with the result, whichever way the result goes.