Add each assessment, start from the typical days for its type, and adjust them to what scoping told you. Each one gets its own reporting and retest days, the whole quote is priced at your day rate, and the days table copies straight into Word or Excel.
Typical testing effort: 3 to 5 days, grey box with accounts and documentation supplied.
| Item | Days | Cost |
|---|---|---|
| Business web application, 2 to 3 roles, limited state change | ||
| Testing | 4 | £4,000.00 |
| Reporting | 1 | £1,000.00 |
| Total | 5 | £5,000.00 |
Testing 4 days, reporting 1 day. Rules of thumb from practice, for sizing a conversation rather than a quote you are held to.
Kept in this browser only, so a refresh loses nothing. Nothing you type here is sent anywhere.
Roles and distinct functions drive the days, not page count: an application with forty pages and six real workflows is smaller than it looks. Each user role multiplies the authorisation testing, because every function has to be tried as every role; an API without a current specification has to be mapped before it can be tested; and a multi-tenant platform adds the tests that one tenant cannot reach another's data.
Scheduling, access and review add elapsed time that is not testing effort, so a five-day test is rarely five days end to end. The questions that settle all of this, and the starting ranges this calculator uses, are in the scoping questionnaire, with a Word template to send the client.
When the scope is agreed, Pental turns it into an engagement with phases, each carrying its own type, test days, scope and checklists, so what you quoted is what the team works to and what the report describes. See the platform.
They are rules of thumb from practice, for sizing a conversation rather than a quote you are held to. They assume grey box testing with accounts and documentation supplied; black box testing adds time for discovery. Roles and distinct functions drive the days far more than page count, so change the figures as soon as the scoping answers say something different.
Because it is real work: reporting typically adds between a fifth and a third of the testing effort. A quote that counts no reporting days is either absorbing the cost, skimping on the write-up or handing over tool output, and a client comparing quotes deserves to see where the days go.
Where the client will want the fixes verified, yes, priced separately so it can be accepted or declined on its own. A retest is usually one to two days for a typical assessment, depending on how many findings it covers.
As a percentage of the total you enter, shown on its own line. The UK standard rate of VAT is 20%; leave it at 0 to quote without tax.
No. The figures are worked out in your browser and kept in this browser only, so a refresh loses nothing. Start again clears them.
Yes. Copy for Word or Excel copies it as a table, which pastes as one into Word, Outlook or Excel, with a plain text copy for anything else. Download CSV gives the same rows as a file.
The tools are free and stay free, and so is our open-source reporting tool. Pental is the platform they come from.
Pental is pentest management and reporting for testing firms: findings scored as you write them, reports in your own Word template, QA review and a white-label client portal. Free trial, no card required.