Pricing Penetration Testing When Somebody Will Always Be Cheaper

Price penetration testing work on scope, coverage and deliverables rather than on days, fix the price only where you have scoped rigorously, charge separately for what costs you separately, and raise rates on new clients first. There is always a cheaper competitor, frequently one that has understood the scope less well than you have, and pricing is the part of running a testing firm least discussed in public and most likely to decide whether the firm survives.

Day rates are a unit, not a strategy

Clients do not buy days. They buy assurance about a system and evidence they can show somebody else. Quoting purely in days invites a negotiation about the number of days, which is really a negotiation about how much of the system you will look at, and that is the one negotiation nobody should want to win by conceding.

Use days internally to plan and to understand your economics. Present scope, coverage and deliverables externally.

Fixed price is a bet on your scoping

Fixed pricing is what most clients prefer and it is perfectly viable, provided the scoping is rigorous and the exclusions are explicit. Firms that lose money on fixed price are almost never slow testers. They are firms that scoped from a description rather than from a structured set of answers, and then absorbed the difference to protect the relationship. Scoping a penetration test without guessing covers the answers that matter.

Retainers change what you get asked

A retainer that draws down against real engagements gives you predictable capacity and gives the client predictable spend and faster access. The underrated effect is on the work itself: retained clients bring architectural questions early, before the thing is built, which is more valuable work than being handed a finished system and asked to find fault with it.

It is also the only pricing model where saying "you do not need a test for this" makes you money rather than costing you money, which is a better position to advise from.

Charge separately for what costs you separately

• Retests, quoted in the original statement of work so they are expected rather than reactive.
• Attestation letters, where producing one takes real time.
• Remediation support beyond questions about the report itself.
• Out-of-hours or weekend testing, which costs your people something real.
• Re-scoping when the environment differs materially from what was described.
• Reissuing a report in somebody else's template, which happens more than anyone expects.

Compete on what a cheaper quote cannot include

You will not win on price against a firm that has misunderstood the scope. You can win on things that are visible before a contract is signed, if you show them deliberately:

What the buyer sees	What it tells them
A scoping call that surfaces something they had not considered	You will find things during the test too.
A redacted sample report	Whether their board will understand the output.
A clear answer to their supplier assessment	You hold their data the way you will tell them to hold theirs.
A retest quoted up front	You expect the findings to get fixed, not just delivered.

Know your delivered-day economics before you discount

Discounting is a decision about margin, and most small firms make it without knowing what an engagement actually earned, because engagement effort, work passed to associates and billing live in three separate systems that never get reconciled. Margin is usually lost somewhere less visible than the rate, in work that is real but unbilled and largely invisible until someone measures it.

Where the time goes	Why it is invisible
Reformatting and assembling the report	It happens after the testing, so it never lands against the engagement in anyone's head.
Rewriting the same finding again	Each instance feels like five minutes. Across a quarter it is days, which is the case for a findings library your team actually uses.
Chasing scope answers and credentials	Spread across a fortnight of email, so it is never counted as a block of time.
Producing attestation letters and re-sending old reports	Small, frequent, and always urgent for somebody else.
Reconciling billing records against work done	Happens at month end, by which point nobody remembers the detail.

None of that is a pricing problem, and raising rates does not fix any of it. It is a delivery-cost problem, and it is worth measuring before the next time you consider discounting.

Firms that can see per-engagement economics discount less often and more accurately, and over a year that beats winning any individual negotiation.

Raise prices on new work first

The least painful way to move your rates is to apply the new number to new clients and hold existing clients for a cycle. It gives you real evidence about whether the market accepts it before you test it on the relationships you cannot afford to lose, and it gives you a straightforward story when you do move them: this is what we have been charging new clients for six months.

What the cheap quote leaves the buyer holding

A buyer comparing two quotes is comparing two numbers, because nothing else in front of them is comparable. The useful move is not to defend your number, it is to make the difference visible in terms they can check, which is also how buyers are told to read quotes in what a penetration test costs.

• Days of actual testing, separated from reporting and project management.
• Whether a retest is included, and for how long after delivery.
• Whether the report is written by the person who did the test.
• What happens when something is found on day one that changes the shape of the engagement.
• Who they will speak to when a finding is disputed six weeks later.

None of that is a claim about quality, which a buyer cannot verify. All of it is checkable, which is precisely why a cheaper quote often will not put it in writing.

Most disputes about price are really disputes about scope discovered late. A quote that states the number of days, the environments, the roles, the retest window and the exclusions removes the argument before it starts, and it costs a paragraph; a penetration testing statement of work is the place to write it. A quote that is silent on exclusions invites the assumption that everything was covered, and that assumption surfaces at the worst time: when the client has had an incident in the part nobody was asked to test.