Penetration Testing Services: What the Quote Must Say Before You Compare Price

Q: What should a penetration testing quote include?

The unit being tested, the target list and exclusions, how much tester time is committed, which accounts and roles the tester gets, the rules of engagement, who does the work, what the report contains, and whether a retest is included. A quote with only a price and a methodology logo cannot be compared with another.

Q: Why do penetration testing quotes differ so much for the same system?

Because they price different things. One quote may cover a single application with one user role; another may cover every role, the API and the admin panel. Tester time, credentials and exclusions change the work more than the system name does, so ask for each in writing.

Q: Is a penetration test the same as a vulnerability scan?

No. A scan runs a tool and lists signatures. A penetration test has a person chain findings, test business logic and try to reach something that matters. If the deliverable is a scanner export, you bought a scan. The vulnerability assessment versus penetration testing comparison covers when each fits.

Q: Should a penetration test quote name the testers?

It should say who performs the work and whether that is the same team that scoped it. You do not need a roster, but you should know whether the work is done by named staff, subcontractors or an automated platform, and who reviews the final report.

Q: Does the price of a penetration test include a retest?

Only if the quote says so. Ask whether a retest is included, how long after delivery you can request it, and which findings it covers. Without it, a fix is untested until your next engagement.

The short answer

A penetration testing quote is comparable only if it states seven things: the unit it counts as in scope, how much tester time is committed, which accounts and roles the tester receives, the rules of engagement, who performs the work, what the report contains, and whether a retest is included. Providers can quote the same system at very different prices because they are testing different amounts of it. Get those seven in writing before you compare price, and treat a quote that names a methodology but none of them as a scan with a pentest label.

Who this is for

This is for the security lead, CTO or procurement owner at a casino, crypto exchange or fintech who holds two or three penetration testing proposals and cannot tell why they differ. It is about reading the quote. For how to scope the test itself for an online casino, see scoping a penetration test for an online casino; for the crypto-exchange version, see scoping a penetration test for a crypto exchange.

The seven lines to look for

Quote line	What to ask	Why it changes the price and the result
Scope unit	Is the unit an application, a domain, an environment, an API, or a number of endpoints?	The same platform is a different amount of work under each unit.
Tester time	How much time is committed, and is it testing time or includes reporting?	Time is the main limit on depth. Two quotes with different time are different tests.
Credentials and roles	Which accounts, roles and tiers does the tester get?	Most serious flaws sit behind a login. A test with no accounts only sees the front door.
Rules of engagement	What is allowed, what is off limits, when can testing run, and who can stop it?	Production, payment flows and third-party systems need explicit limits and permission.
Who tests	Named staff, subcontractors or an automated platform? Who reviews the report?	The answer tells you how much judgement is behind the findings.
Report	What does a finding contain, and what is said about what was not tested?	A report is the product. See what a real pentest report looks like.
Retest	Included or not, within what window, covering which findings?	Without it a fix is unverified. See what counts as fixed.

Line 1: what counts as the scope

Providers price by a unit, and it is rarely the one you think in. You may say "the cashier"; the quote may say "one web application". A casino cashier is a web front end, one or more APIs, an admin panel and payment-provider callbacks, and a quote that counts one application may cover only the first. Ask what is named in scope, what is named out of scope, and what happens when the tester finds an adjacent system that was not listed: is it skipped, or is it a change order?

Line 2: how much tester time

Depth is mostly time. A quote should say how much tester time is committed to testing, separately from setup and reporting, and over what calendar window. You do not need to know a market rate to compare this; you need to know that two quotes with different committed time are not testing the same amount. Ask what is deprioritised if the time runs short, because something always is.

Line 3: credentials and roles

Many serious flaws sit behind authentication: broken access control between players, between operator staff roles, between tenants. A test given no accounts cannot find them. The quote should list which roles the tester receives, whether a high-privilege and a low-privilege account are both provided, and whether the tester may create their own accounts. If the scope includes a payment or wallet flow, say whether test funds or a sandbox are used so that nothing real moves.

Line 4: rules of engagement

The rules of engagement set what the tester may do, on which systems, at what times, and how to stop. They should name the production boundaries, any rate or load limits, which third-party systems are untouched, and an emergency contact on each side. Written authorisation matters: a test of a system you do not control, such as a payment provider or a shared host, needs that party's permission, and the quote should say who obtains it. The general approach is described in NIST SP 800-115 on technical security testing.

Line 5: who performs the work

Ask whether the people who scope the work are the people who test it, whether any part is subcontracted, and whether any part is automated. Automated tooling is a legitimate part of a test; it is not the test. A report should be reviewed by a person who can explain each finding and its impact on your business. For the argument that fully automated testing misses what matters, see why a purely automated pentest falls short.

Line 6: the report

The deliverable should give each finding a title, the affected asset, evidence, impact, a ranking you can use, and a concrete fix. It should also say what was not tested and what assumptions the tester made. Ask for a redacted sample before you sign. A report that cannot be given to your auditor or your engineering team without rewriting it is not finished.

Line 7: the retest

A finding is not closed when the report arrives. The quote should say whether a retest is included, how long after delivery you may request it, and whether it covers all findings or only the higher-ranked ones. The detail on what a retest checks is in the retest article.

Red flags in a quote

The deliverable is described as "scan output", "automated report" or "tool export".
No committed tester time, or time expressed only as a price.
No mention of credentials or roles.
A methodology named (such as the OWASP Web Security Testing Guide) with no statement of how it applies to your scope.
No sentence on what is out of scope or what was not tested.
A compliance badge promised without naming the standard or the scope it applies to.

Limitations

This is a reading guide, not a price list or a recommendation of any provider. It states no market prices, no durations and no AnySec-original figures. Regulated programmes such as card-payment or financial-sector testing frameworks have their own requirements for scope and tester qualification; read the current text of the one that applies to you.

What to do next

Put your proposals side by side against the table above and send the gaps back as questions. If you want a quote that answers all seven lines up front, request a fixed quote for a penetration test and tell us the application types, the user roles and any third-party systems involved. The Penetration Testing page describes how an engagement runs from scope to retest. If you still need to decide between a scan and a test, the Vulnerability Assessment page covers the lighter option.

Frequently asked questions

What should a penetration testing quote include? Scope unit, tester time, credentials and roles, rules of engagement, who tests, the report, and the retest.

Why do penetration testing quotes differ so much for the same system? They price different amounts of testing. Compare committed time, roles and exclusions, not the system name.

Is a penetration test the same as a vulnerability scan? No. A scan lists signatures; a test has a person chain findings and test business logic.

Should a penetration test quote name the testers? It should say who does the work, whether any is subcontracted or automated, and who reviews the report.

Does the price of a penetration test include a retest? Only if the quote says so. Ask about the window and the findings covered.

Sources and review

This article describes procurement practice in general terms. It refers to NIST SP 800-115, Technical Guide to Information Security Testing and Assessment and the OWASP Web Security Testing Guide as general references, and cites no statistics, prices or AnySec-original numbers, case results or SLA figures. Author: AnySec Engineering. Published 2026-10-12; last reviewed 2026-10-12.