What Does “Cheap” Penetration Testing Actually Buy?

Where a low price actually comes from

There are only four ways to make a penetration test cheaper, and they are not equally acceptable.

1. Lower overheads — legitimate

A small consultancy has no offices to fund, no account managers and no sales team. That is a genuine cost difference and it reaches you as a lower day rate without affecting the work. Our own rates sit below the large consultancies for exactly this reason.

2. Fewer days — legitimate, if you know

A three-day test costs less than a six-day test because it covers less. That is fine when the scope genuinely warrants three days, and a problem when a provider quotes three to win the work and then cannot cover what you needed. Always compare day counts, not totals.

3. Automation instead of testing — usually not acceptable

Running a vulnerability scanner and formatting the output takes a fraction of the time. It is also not a penetration test. It will not find broken access control, business logic flaws, or the chain of three minor issues that together give an attacker your database. Most compliance requirements that specify penetration testing will not accept it.

4. Junior staff — depends entirely on supervision

Large firms often sell senior expertise and staff with juniors, because that is how the economics work. Sometimes that is fine with proper review. Sometimes you are paying for someone learning on your systems.

When cheap is genuinely the right answer

We would rather say this plainly than pretend otherwise:

• Small, contained scope. A brochure website with a contact form does not need six days. A short test is the correct answer, not a compromise.
• You have already had a thorough test and want a lighter check after a specific change.
• Your real need is Cyber Essentials. If a customer's requirement is satisfied by certification, a penetration test is an expensive way to answer the wrong question.
• You have foundational gaps. If you have no multi-factor authentication, unsupported software in production or untested backups, spend the money fixing those. A test will confirm what you already suspect.

When cheap costs more

The failure mode is nearly always the same: the report has to satisfy somebody else.

A tender evaluator, a client's security reviewer, an auditor, an underwriter. If the report comes from an unaccredited provider, covers the wrong scope, or is visibly scanner output, it gets rejected. You then commission a second test under time pressure and pay twice — plus whatever the delay cost you.

That is the arithmetic that matters. A £1,200 test that fails the requirement is more expensive than a £3,000 test that passes it.

How to tell what you are being offered

Four questions that expose the difference quickly:

• How many days of manual testing, excluding report writing? If the answer is vague, that is the answer.
• Who is the named tester and what do they hold? "One of our qualified team" tells you something.
• Can I see a redacted sample report? Any competent provider has one. Refusal is informative.
• Is retesting included? Frequently excluded from a low quote and charged later at full rate.

Our pricing page explains what actually drives the day count, and how to compare providers covers this in more detail.

What we do about it

We quote on a call, for a defined scope, and hold the price. Retesting is included rather than sold later. And if a scoping conversation suggests you need less than you asked for — or something other than a penetration test entirely — we will tell you.

That is not generosity. A client who buys the wrong thing does not come back.

Common questions