The price is set before the test begins.By you, not by us.

The question is not whether to order a pentest. The question is when, and what you order it against.

A penetration test is not the same thing as a vulnerability scan. A scan looks for known patterns in code and configuration. A pentest hires a person who tries to get in, the way an attacker would, and then proves what they actually reached.

Tests are usually split by how much the tester is told in advance. Black box means the tester starts with no insight, like an outside attacker. White box means full insight, source code and documentation included. Grey box sits in between, and is the most common choice in practice.

NIST describes the work in four phases: planning, discovery, attack and reporting. Two of the four sit before the attack. The mapping is the part that takes time, and it is exactly as necessary as it is slow.[01]

Most orders we see arrive in one of two moments. Either right before a major launch, or right before an audit. Both moments share the same problem. There is no time left to fix what is found before the thing the test was meant to protect is already live, or already reviewed.

The right timing sits earlier. Before launch, not the same week as it. After a major infrastructure change, not a year later. And routinely, regardless of whether anything happened, to know whether what protected you last year still does.

The Swedish cybersecurity act implements NIS2 and requires those covered to have procedures for assessing whether their security measures actually work. Assessing that without testing it is hard, and testing once every three years is hard to call a routine.[02][03]

An engagement is priced mainly on how much needs mapping and how much needs proving, not on how advanced the pretend attacker is. The wider the scope, the more of the expensive time goes to mapping instead of judgement.

That is why a cheap, wide test is rarely a good deal. Mapping eats the budget, and what is left for judgement shrinks. A narrower scope, chosen with care, buys more judgement for the same amount.

A certification such as CREST shows the tester passed a practical exam against real scenarios. It does not show your specific environment will be tested well, but it is a reasonable floor to require.[05]

Also ask which methodology is used, and ask for a name. Frameworks such as OWASP's testing guide exist so a test can be measured against something established, not just the tester's own feel.[06]

• How many testers work the engagement, and is that enough for the scope you set?
• Is a retest of the most serious findings included, or is that an add-on?
• Is a name in the report, or just the company's?
• Who on your side receives it, and what are they expected to do with the result?

The answers decide whether you are buying judgement or just a walkthrough.