Send the same requirement to three suppliers and you will get three different day counts, usually spanning a factor of two. That is rarely because one of them is overcharging. It is because each has made different assumptions about what the work includes, and those assumptions are the part you should be comparing. The NCSC’s guidance on buying penetration testing makes the same recommendation: define the scope yourself rather than letting each supplier define it for you.
Scope assumptions do most of the damage
A quote for a web application test depends on how many user roles exist, whether testing is authenticated, and how many distinct functions the application has. Supplier A may have assumed one role and unauthenticated testing. Supplier B may have assumed four roles, authenticated coverage and a mobile client that talks to the same API. Both read the same paragraph from you. The fix is on your side: write the scope as a table with counts, and every proposal will be answering the same question.
What is included after the testing stops
The cheapest quotes often stop at the report. Ask specifically whether the price includes a retest of the findings, a debrief call with your technical team, an executive summary suitable for a customer or board pack, and a letter of attestation if you need one for a contract. Retesting is the item that most often appears later as an additional cost, and it is the one you will certainly want, because a report showing that issues were fixed is worth considerably more to a customer than one listing what was broken.
“When a quote comes in dramatically cheaper, I tell clients to ask two questions: who will actually do the work, and how many days are on the ticket. Half the time the answer is a junior running an automated scan with a template report, and it is not a cheaper version of the same thing. It is a different product with the same name.”
William Fieldhouse, Director, Aardwolf Security Ltd
Who does the work, and where
Consultant seniority moves the price more than any other single factor. A test led by someone with a decade of experience costs more per day and typically finds more in fewer days, which sometimes makes it cheaper overall. Ask whether the named consultant in the proposal is the person who will run the engagement, whether the work is delivered in the UK, and what vetting the team holds, since regulated clients and public sector contracts often require security clearance. Accreditation matters here too, because maintaining it costs the supplier money and that shows up in the rate.
Making proposals comparable
Send an identical scope pack to everyone and ask for the response in the same shape. Include the asset list with counts, the environments in play, your deadline, and whether testing must run out of hours. Ask each supplier for days broken down by phase, a sample report from similar work, and the assumptions they have made in writing. Then compare like for like. When you request a quote for penetration testing on this basis, differences in price start to mean something, and choosing the right penetration testing company becomes a judgement about depth rather than a guess.
Frequently asked questions about testing prices
These questions come up whenever proposals reach a finance review.
Is a fixed price better than a day rate?
A fixed price for a well defined scope is fine and it depends on the scope being genuinely fixed. Where the estate is unclear, expect a discovery phase first, otherwise the fixed price simply contains a large contingency you are paying for.
Should you always take the middle quote?
No. Read the assumptions and pick the proposal that covers what you actually need. Sometimes that is the most expensive one, and sometimes the cheapest is right because it correctly scoped a smaller job.
