A web application penetration test is priced on tester-days, so cost scales with scope, not a fixed rate. The main drivers are application size, the number of user roles (each must be tested), business-logic complexity, the number of APIs and integrations, the depth and knowledge level (black/grey/white box), and whether a retest is included. A small single-role app is at the lower end; a large multi-role app with complex workflows takes more days. Manual testing costs more than a scan because you're paying for the human work that finds the real flaws. Scope tightly, choose grey box, and confirm the manual proportion to avoid overpaying. See the full cost guide for the wider picture.
// 01 How web app tests are priced
Almost every reputable provider prices a web application test the same way: they estimate the number of tester-days the application needs for thorough manual coverage, and multiply by a day rate. That's why a fixed "web app pentest = $X" figure is meaningless — a five-page brochure site and a multi-tenant SaaS platform are not the same amount of work. The corollary is important: a quote given without anyone looking at your application is a guess. Accurate pricing comes from scoping, and the levers below are what a good provider assesses to size the engagement.
// 02 The six cost drivers
Application size
Pages, features and endpoints. More surface area is more to test — the most obvious lever.
User roles
Each distinct role and permission level must be tested, especially for access-control flaws. Roles add days fast.
Business-logic complexity
Multi-step workflows, payments, approvals — the logic a scanner can't test and a human must reason about.
Depth & knowledge level
Black, grey or white box — more depth (and white-box code access) means more days.
Retest & reporting
An included remediation retest and detailed, mapped reporting add value and a little cost.
The two that surprise buyers most are roles and business logic — because that's exactly where manual testing spends its time, and where the serious findings hide.
// 03 Why manual costs more than a scan (and is worth it)
A scan runs in hours for a licence fee; a penetration test takes days of a senior tester's time. That's the whole cost difference — and it's the whole value difference too. The scanner finds known, pattern-based issues; the human exploits and chains findings, and probes the business logic and access control no tool can understand — which is where the high-impact vulnerabilities actually are. This is why "a scan sold at pentest prices" is the market's most common overcharge: you pay for depth you don't receive. When comparing quotes, the single most revealing question is what proportion of the engagement is manual.
// 04 Scoping for value
You can lower cost without losing the findings that matter:
- Test the highest-risk app first, and its authenticated functionality, rather than everything at once.
- Choose grey box — credentials put the tester's time into the authenticated areas where serious flaws live, not into getting in.
- Provide good docs and a stable test environment — wasted setup time is wasted budget.
- Layer continuous scanning underneath for hygiene between annual tests.
- Confirm the manual proportion so you're not paying premium rates for automation.
// 05 Frequently asked questions
How much does a web application penetration test cost?
It's driven by scope, priced on tester-days. A small single-role app is at the lower end; a large multi-role app with complex logic and integrations costs more. A real number comes from a provider scoping your specific app — ranges quoted without seeing it are guesses. The levers are size, roles, complexity and depth.
What factors affect the cost?
Application size (pages, features, endpoints), number of user roles (each tested), business-logic complexity, number of APIs and integrations, test depth and knowledge level (black/grey/white box), and whether a retest is included. Roles and business logic add days fastest.
Why is manual testing more expensive than a scan?
You're paying for skilled human time, not tool licences. A scan runs in hours and finds known issues; a manual test takes days of a senior tester exploiting findings and probing business logic and access control that scanners can't. That human work finds the real vulnerabilities.
How can you reduce cost without losing value?
Scope tightly to the highest-risk app and its authenticated functionality, choose grey box, provide good docs and a stable environment, layer continuous scanning for hygiene, and confirm the manual proportion so you don't pay premium rates for a scan.
// 06 Related reading
- How much does penetration testing cost? — the full cost guide across all test types.
- Black/grey/white box — the depth lever explained.
- Manual vs automated — why the human work costs more.