A penetration test is one of the most frequently misunderstood purchases in IT security. Companies buy them because a customer required it, because their cyber insurance application asked about it, or because an auditor checked a box. Many of those purchases produce a report that sits unread. The ones that produce value are the ones where the buyer understood what they were purchasing, selected the right scope, and had a plan for acting on findings. This guide covers what penetration testing is, what it costs, and how to get value from it.
What a Penetration Test Actually Is
A penetration test is an authorized, simulated attack against your systems by a qualified security professional, intended to identify exploitable vulnerabilities before a real attacker does. The tester uses the same techniques an attacker would use — scanning for open ports, identifying unpatched software, testing authentication weaknesses, attempting privilege escalation — but is bound by a rules-of-engagement agreement that defines scope, permitted techniques, and notification procedures.
The output is a report documenting the vulnerabilities discovered, the evidence of exploitation (screenshots, tool output, privilege escalation chains), and remediation recommendations. A quality pentest report distinguishes between theoretical vulnerabilities (the software has a known CVE) and proven exploitability (the tester actually exploited the CVE in your environment and achieved specific access).
Penetration Test vs Vulnerability Scan: Not the Same Thing
A vulnerability scan is automated tool output — a scanner probes your systems, compares what it finds against a database of known vulnerabilities, and reports everything it flags. It typically produces hundreds or thousands of findings, many of which are false positives, informational, or not exploitable in your specific environment.
A penetration test uses vulnerability scan output as a starting point, but the value comes from what a human tester does with it: chaining multiple low-severity findings into a high-impact attack path, attempting to actually exploit vulnerabilities rather than just flagging them, testing application logic and authentication flows that automated tools can't evaluate, and providing context about which findings represent real risk in your specific architecture.
Many compliance requirements that say "penetration test" will accept a vulnerability scan with manual review as a substitute. If your requirement is primarily about satisfying an audit, confirm with your auditor what they actually need. If your requirement is about identifying real risk, a vulnerability scan is not sufficient.
Types of Penetration Tests
External network penetration test: Tests your internet-facing systems — web applications, VPN concentrators, email servers, public-facing APIs — from an attacker's perspective outside your network. The most common pentest type for SMBs. Typically 3–5 days of testing work.
Internal network penetration test: Tests your internal network from a position inside it — either physically (tester comes on-site) or via a remotely deployed agent simulating an attacker who has already breached the perimeter or a malicious insider. Reveals lateral movement paths, credential exposure, and privilege escalation risks that are invisible from outside.
Web application penetration test: Focuses specifically on a web application or API, testing for OWASP Top 10 vulnerabilities (SQL injection, cross-site scripting, broken authentication, and others) and application-specific logic flaws. If you have a customer-facing application handling sensitive data, this is a separate and necessary test from a network pentest.
Social engineering (phishing simulation): Tests whether your employees can be manipulated into providing credentials or access. Not technically a network pentest — it tests your human controls. Phishing simulation can be run as a standalone service or as part of a broader test.
What a Penetration Test Costs
Penetration test pricing depends heavily on scope, complexity, and firm. Based on publicly available market data for 2024–2025:
External network pentest (SMB scope, <50 IPs): $3,000–$8,000 from a boutique security firm or individual practitioner. Quality varies significantly.
External network pentest (mid-market scope, 50–200 IPs + VPN + email infrastructure): $8,000–$20,000.
Web application pentest (single application, standard scope): $5,000–$15,000 depending on application complexity and number of user roles tested.
Combined external + internal + web app: $20,000–$60,000 for a comprehensive engagement. This is the tier enterprise procurement or compliance-driven programs often require.
Very low pricing (under $2,000 for an external pentest) is almost always a vulnerability scan with a template report, not a real penetration test. The labor cost of a qualified tester spending 3–5 days on your environment cannot compress below $3,000–$5,000 at any credible firm.
When You Actually Need a Penetration Test
Penetration testing is appropriate and valuable in specific circumstances:
When a compliance requirement genuinely requires it (SOC 2 TSC requires testing of security controls; PCI-DSS Requirement 11 requires external and internal penetration testing annually; CMMC requires penetration testing for Level 3).
When you've deployed a new externally accessible application and need to know whether it's secure before it's exposed to real traffic.
When a cyber insurance policy requires evidence of penetration testing as a condition of coverage.
When a major customer's procurement process specifically requires a pentest report as a vendor security qualification.
When you've made major infrastructure changes and want an independent assessment of whether the changes introduced new vulnerabilities.
What penetration testing is not: a substitute for fixing known vulnerabilities, a substitute for ongoing monitoring, or a meaningful exercise if you don't plan to act on the findings. A pentest report you don't remediate is an attacker's roadmap.
Frequently Asked Questions
How do you find a qualified penetration tester?
Look for testers with OSCP (Offensive Security Certified Professional), CEH (Certified Ethical Hacker), or GPEN (GIAC Penetration Tester) credentials. OSCP in particular requires demonstrating practical exploitation skills rather than passing a multiple-choice exam. Ask for sample (redacted) reports from comparable engagements, and for references at companies that can speak to the quality of findings and the remediation guidance.
What is the right frequency for penetration testing?
PCI-DSS requires annual external and internal penetration testing, plus testing after any significant infrastructure changes. SOC 2 Type II auditors typically expect evidence of annual penetration testing as a design of controls. For companies without a compliance mandate, an annual external pentest and a biennial internal pentest is a reasonable baseline. After a breach or near-miss, an immediate test of the affected scope is warranted.
What happens after a penetration test?
The finding report should be reviewed jointly with the testing firm to understand severity ratings and recommended remediation. Findings should be entered into your risk register and assigned to owners with remediation timelines. Critical and high findings should typically be remediated within 30 days; medium findings within 90 days. A retest of critical findings (confirming they're actually patched) is a standard deliverable from reputable firms.
← EDR for SMBs | Incident Response: Who to Call When You Have a Breach →