What you are actually paying for in a penetration test
A penetration test is skilled labour. The price is the number of tester-days the scope needs, multiplied by the provider's day rate, plus fixed items such as project management, the report and a retest. A tester-day is one qualified person working for one day.
Providers measure scope in units, and each unit adds testing time: pages, functions and user roles for a web application, endpoints for an API, live hosts for a network, platforms and builds for a mobile app, and accounts and services for a cloud environment.
| Cost component | What it covers |
|---|---|
| Scoping and planning | Scoping call, asset list, rules of engagement, authorisation letter |
| Testing | Tester-days multiplied by the day rate, split between reconnaissance, exploitation and analysis |
| Project management | Coordination, status updates and the test-window schedule |
| Reporting and debrief | Executive summary, CVSS-rated findings, proof of concept, remediation advice, a findings call |
| Retest | Verification that fixes work, within a stated window |
Day rates also reflect seniority. A project led by a senior tester with advanced credentials costs more per day than one run by a junior team, and it usually needs fewer days to reach depth. Ask who leads the project, who does the testing and how much senior time the quote includes.
Penetration testing pricing models
Providers sell penetration testing under four commercial models. The model decides how risk is shared: with a fixed scope the provider carries the risk of overruns, with a day rate the buyer does.
| Model | How it works | Works well when | Check before signing |
|---|---|---|---|
| Fixed scope | One price for a defined scope, test window and report, often with one retest | Assets are stable and you need a figure for budget approval or an audit | How scope changes are priced and what is excluded |
| Time and materials | You pay for tester-days used at an agreed day rate, with an estimate | Scope is uncertain, for example a large internal network or a red team exercise | A cap on days and written approval for extra days |
| Subscription or PTaaS | A platform plus testers, with on-demand or continuous testing for a recurring fee | Teams release often and want findings between annual tests | Which parts are automated, who validates findings and how depth compares with a full manual test |
| Retainer | A block of tester-days reserved for a period and used across projects | An organisation runs many small projects and releases | What happens to unused days, response times and which testers are assigned |
Penetration testing cost by test type
Price follows tester-days, so each test type is described here by the scope unit providers count and the work that adds effort. Ask every provider for a tester-day estimate per row of your scope. The guide to types of penetration testing explains what each test covers.
| Test type | Scope unit providers count | What adds effort |
|---|---|---|
| Web application | Pages, functions and user roles | Several roles, multi-step workflows, custom authentication, file upload, payment flows |
| API | Endpoints and methods | Authorisation rules per role, GraphQL schemas, several versions, third-party integrations |
| Mobile application | Platforms and app builds | iOS and Android builds, local storage, certificate pinning, root or jailbreak detection, the back-end API |
| External network | IP addresses and exposed services | Number of live hosts, remote access and VPN, cloud-hosted assets |
| Internal network | Network segments and hosts | Size of the Active Directory environment, segmentation, number of sites, onsite access |
| Cloud configuration | Accounts, subscriptions and services | Number of accounts and regions, identity and access design, depth of configuration review |
| Red team | Objectives and campaign length | Duration, number of objectives, physical and social engineering, detection and response evaluation |
| Social engineering | Mailboxes, phone numbers and sites | Number of targets, campaign type (phishing, voice, onsite), reporting by department |
What pushes a penetration testing price up or down
Eight factors move the estimate more than anything else. Changing them is the fastest way to bring a quote in line with a budget, and each is a scoping decision, not a negotiation point.
- Size of scopeMore applications, endpoints or IP addresses mean more tester-days; trimming scope to the systems that hold sensitive data lowers the estimate.
- Authenticated rolesEvery user role adds a set of permissions to test, especially when roles interact.
- IntegrationsPayment gateways, single sign-on, third-party APIs and message queues each widen the attack surface.
- EnvironmentA staging copy of production is faster and safer to test than a live system with traffic and change freezes.
- Compliance deliverablesEvidence for PCI DSS, ISO/IEC 27001 or a regulator adds report sections and sometimes a separate attestation letter.
- UrgencyShort notice and tight windows reduce a provider's scheduling options.
- Onsite workInternal, wireless and physical tests may need testers at your site in Dubai or Abu Dhabi.
- Report formatReports for several audiences, extra languages or a findings workshop add writing and meeting time.
UAE-specific cost factors
Cost in the UAE is shaped by a few local requirements. They do not apply to every buyer, so check which ones match your situation before you ask for quotes.
- VAT. The standard VAT rate in the UAE is 5%, as published by the Federal Tax Authority. Ask each provider to show VAT as a separate line so quotes compare on the same basis.
- Onsite days. Internal network, wireless and physical tests in Dubai or Abu Dhabi can need onsite days, access passes and escorts. Ask whether travel and onsite time sit inside the quote.
- Compliance evidence. A test written up for the UAE regulators and standards that apply to you needs the right report format from the start, which is cheaper than rewriting it later.
Cheap quote versus a real penetration test
A low price usually means less manual work. Some providers sell an automated vulnerability scan under the name of a penetration test, and the report reads like a scanner export. A scan is a useful control, but it is a different product with a different price.
| Aspect | Scanner-only report | Manual penetration test |
|---|---|---|
| Method | Automated tools run against targets | Testers combine tools with manual analysis and exploitation |
| Findings | Possible issues ranked by tool severity | Confirmed issues with proof of concept and attack chains |
| False positives | Passed on to the reader | Validated by the tester before reporting |
| Business logic | Limited coverage | Tested by hand, such as workflow bypass and price tampering |
| Report | Tool export | Executive summary, CVSS-rated findings, remediation steps |
| Retest | A repeat scan | Targeted verification of each fix |
| Compliance use | Supports vulnerability scanning requirements | Supports penetration testing requirements such as PCI DSS Requirement 11.4 |
Four signs separate a scanner product from a manual test:
- The quote shows no tester-days or only a flat "assessment" fee.
- The sample report is a tool export with generic descriptions.
- Business-logic and authorisation testing are not mentioned.
- The price is far below other quotes for the same scope.
How to get comparable penetration testing quotes
Quotes compare only when every provider prices the same scope. Write the scope once and send it to each provider on your shortlist. The guide to choosing a penetration testing company in the UAE adds 20 questions and a printable RFP checklist.
- Assets. URLs, applications, API definitions, IP ranges and cloud accounts in scope, with exclusions.
- Roles. The user roles to test and whether the provider receives test accounts.
- Depth. Black, grey or white box, and whether source code is shared.
- Environment. Production or staging, plus the test window and change freezes.
- Standards. PCI DSS, ISO/IEC 27001, DESC Cyber Force or regulator requirements the report must support.
- Deliverables. Executive summary, technical report, findings call, attestation letter if needed.
- Retest. Number of rounds, time window and which findings are covered.
- Commercials. Tester-days, day rate, fixed items, payment terms and VAT shown separately.
How to lower the cost of a penetration test without lowering its value
The cheapest tester-day is the one you do not need to buy. Preparation removes idle time, and focus removes low-value scope.
- Prepare accounts and access. Have test accounts, VPN access and allow-listing ready on day one, so testers do not wait.
- Provide documentation. Architecture diagrams, API definitions and data-flow descriptions shorten discovery, especially in grey box and white box tests.
- Use a stable environment. Freeze changes during the test window and use a staging copy that matches production.
- Scope by risk. Test the systems that hold sensitive data or face the internet first, and cover lower-risk systems in later cycles.
- Fix known issues first. Clear findings from earlier scans and tests before the new test, so testers spend time on new weaknesses.
- Bundle related tests. One engagement covering web, API and network usually takes less management than three separate projects.
- Plan the calendar. Book early, because short-notice work reduces the provider's scheduling options.
- Agree the report format once. Decide the audiences and templates up front so the report is not rewritten.
Do not trade depth for price. Cutting manual testing, authenticated roles or the retest lowers the quote and the value together.
Budgeting penetration tests across the year
Treat penetration testing as a yearly programme with triggers, not as a one-off purchase. The table shows the tests most organisations plan and the reason for each.
| Trigger | Test to plan | Why |
|---|---|---|
| Yearly cycle | External and internal network tests | PCI DSS Requirement 11.4 asks for both at least every 12 months where it applies |
| Major release or redesign | Web application, API and mobile tests | New code and integrations introduce new weaknesses |
| Significant infrastructure change | Targeted network or cloud test | PCI DSS also asks for testing after significant change |
| Audit or certification date | Test and retest before the audit | Evidence must be final when the assessor arrives |
| Mature security programme | Red team or purple team exercise | Tests detection and response beyond technical controls |
Spreading tests across the year avoids one large spend, and agreeing annual terms with one provider keeps scope and report format consistent from cycle to cycle.
The cost of not testing
A penetration test finds weaknesses before an attacker does, and a breach is expensive. IBM's 2026 Cost of a Data Breach research puts the average breach in the Middle East at US$8 million, and detection and escalation alone at US$1.9 million per breach in the region.
- Average cost of a data breach in the Middle East
- US$8 million
- Detection and escalation cost per breach in the region
- US$1.9 million
Compare a scoped test with that exposure when you set the budget. Regular testing also supports compliance: PCI DSS v4.0.1 Requirement 11.4 asks for internal and external penetration testing at least once every 12 months and after significant changes.
Frequently asked questions about penetration testing cost
How much should a penetration test cost?
There is no fixed price, because a penetration test is priced by scope. Providers estimate the tester-days needed for your applications, APIs, IP ranges and user roles, then add reporting and retesting. A test tied to PCI DSS Requirement 11.4 or to DESC Cyber Force work adds deliverables that change the estimate. Ask for a written, scoped quote that shows tester-days, deliverables, retest terms and VAT, and compare quotes on that basis.
Why do quotes for the same test differ so much?
Quotes differ because providers make different assumptions about depth, tools and reporting. One quote may price a scanner run with a short report, another a manual test with exploitation, CVSS-rated findings and a retest. The number of tester-days, the seniority of testers, credentials such as CREST accreditation and the number of user roles tested also move the price. Ask each provider to list its assumptions so the quotes cover the same scope.
Is a retest included in the price?
It depends on the quote. Some providers include one retest within a stated window, and others price it separately. Ask for the retest terms in writing: the number of rounds, the time window after the report and which findings are covered. A retest confirms that remediation works, and some compliance reviews for PCI DSS or ISO/IEC 27001 ask for that evidence, so budget for it from the start.
Does VAT apply to penetration testing services in the UAE?
The standard VAT rate in the UAE is 5%, according to the Federal Tax Authority. Whether VAT applies to a given supply, or a special rule changes it, depends on facts such as where the service is supplied and the customer's registration. Ask the provider to show VAT as a separate line on the quote, and confirm your own treatment with a tax adviser or the Federal Tax Authority.
Can a small business afford a penetration test?
Often, when the scope is narrow. A small business can start with an external network test or one web application, which keeps tester-days low, and fixed-scope quotes or PTaaS subscriptions make the budget predictable. If you process card payments, PCI DSS Requirement 11.4 asks for testing at least every 12 months, so plan the test as a yearly budget line. The guide to choosing a provider shows how to compare options.
Fixed price or day rate: which is better?
A fixed price suits stable scope because it gives a known budget and a defined report. A day rate suits uncertain scope, such as a red team exercise or a large internal network, because you pay for days used. Whichever model you choose, ask for an estimate of tester-days, a cap on extra days and written approval for any scope change before the provider continues.
Is a vulnerability scan cheaper and enough?
A vulnerability scan is cheaper, but it does not replace a penetration test. A scan lists possible weaknesses; a penetration test proves which ones an attacker can exploit and how far they lead. PCI DSS treats vulnerability scanning and penetration testing as separate requirements, so a scan report does not satisfy Requirement 11.4. Use scans between tests and a manual penetration test at least once a year.
Sources and updates
Pricing models and cost drivers on this page reflect how providers scope penetration testing. Regulatory and statistical facts come from the official sources below, and the page is reviewed every quarter as described in the methodology.
- IBM Cost of a Data Breach Report 2026: Middle East findings
- UAE Federal Tax Authority: Value Added Tax
- CREST: Dubai Cyber Force programme
- DESC certified providers register
- PCI Security Standards Council
Related guides: Is penetration testing mandatory in the UAE? and types of penetration testing.
Last updated