Fast CREST penetration testing › What a tester-day buys
Penetration testing is sold in tester-days. One tester, one working day. The rate is fairly public, roughly £800 to £1,200 in the UK for accredited work, and the interesting variable is not the rate but the count.
Two quotes at the same day rate can differ by a factor of three, and the reason is always the count. The trouble is that a quote which states the total price but not the day count gives you no way of seeing that. So the first rule of reading a penetration testing quote is that a quote without a day count is not a quote, it is a price, and you should ask for the count before you compare anything.
What is actually in a day
A tester-day is not eight hours of typing exploits. Roughly, across a typical engagement, it divides like this.
| Activity | Share of the engagement | What it produces |
|---|---|---|
| Setup, access checks, environment familiarisation | Most of day one | Working access, a map of the target, confirmation the scope is what was agreed |
| Systematic coverage against the methodology | The bulk of the middle | The findings that are found by looking properly rather than by luck |
| Chasing what looks interesting | Varies, and it is where the good findings come from | Business logic flaws, chained issues, the things tooling never surfaces |
| Evidencing each finding properly | Continuous, and consistently underestimated | Reproducible steps your developer can follow without ringing anyone |
| Writing up | Half a day to two days | The report |
| Peer review and quality assurance | Half a day to two days | Severities that survive scrutiny, findings that are actually supported |
Two observations from that table. The first is that writing and reviewing are a real share of the engagement, and a quote which prices only the testing has moved that cost somewhere: either into unpaid overtime, or out of the deliverable. The second is that day one is largely not testing. That is why very short engagements have poor value per day, and why a two-day test is not two fifths of a five-day test.
The arithmetic that drives the count
Four things multiply, and if you know them you can sanity-check any quote in about five minutes.
Surface area
Ten external IP addresses with three live services is a small job. Ten IP addresses fronting forty virtual hosts is not, and it is the same line in a scope document. For applications, count distinct functional areas rather than pages: an authentication flow, a payments path, a file upload, an admin console and a public API are five areas, however they are navigated.
User roles
This is the biggest single multiplier and the one most often left out of a cheap quote. Testing an application with four user roles properly means testing what each role can do, and then testing what each role can do that it should not, including reaching another user's data at the same privilege level and reaching a higher privilege level. Four roles is not four times one role, but it is not one role either, and a quote that prices an application with logins the same as one without has almost certainly not planned to test authenticated.
Depth
Unauthenticated scanning of a perimeter is fast. Authenticated application testing is slower. Source-assisted review is slower still and finds things the other two cannot. These are three different products and they are all called a penetration test.
Evidence standard
A finding written up as "SQL injection present in search parameter" takes ten minutes. The same finding written up so that a developer can reproduce it, understand the impact on your data specifically, and verify their fix, takes rather longer. You want the second one, and it is part of what the count pays for.
Sanity-checking a quote
Take the scope you actually have and ask whether the count is plausible against these rough shapes. They are honest working figures rather than a price list, and a quote materially below them is telling you something.
| Scope | Typical tester-days |
|---|---|
| External infrastructure, up to 10 IPs | 2 to 3 |
| Brochure or CMS website, unauthenticated | 2 to 3 |
| Web application, one role, authenticated | 3 to 5 |
| Web application, three to four roles, authenticated | 5 to 8 |
| Web application plus its API, multiple roles | 8 to 12 |
| Internal network, single site | 5 to 10 |
| Cloud tenant configuration review | 3 to 8, depending on account sprawl |
| Mobile application plus backend | 8 to 12 |
If you have a multi-role application and the quote says two days, the provider has either misunderstood the scope or is planning a different piece of work to the one you asked for. Neither is a reason to walk away on its own, and both are a reason to ask the question before you sign.
Why a ten-day job cannot become a four-day job
This is worth stating plainly because it is the most common request a testing provider receives when a deadline moves. Testing time is the one clock in an engagement that does not compress. Scoping compresses to a call, scheduling compresses depending on what is free, reporting compresses somewhat, and critical findings can be reported the moment they are confirmed rather than held for the document.
The testing itself does not. A ten-day job delivered in four days is not a faster ten-day job. It is a four-day job with six days of coverage missing, and an honest report will say which six. The choice available to you when a date moves is to reduce the scope deliberately, so that what is tested is tested properly and the report states clearly what was left out, or to move the date. Compressing the days while keeping the scope is the option that produces a document rather than an assessment.
Comparing two quotes, properly
Put both on the same basis before you look at the totals.
- Divide each total by its day count. If one will not give you a count, you cannot do this, which is itself the comparison.
- Check both counts against the same scope, including the same number of roles and the same depth. Quotes routinely differ because they priced different work.
- Check what the count includes. Is the write-up in it? Is peer review? Is a retest, and within what window?
- Check who does the work. The rate difference between a senior tester and a junior one is real, and so is the difference in what they find.
- Then compare the totals, which by this point usually explain themselves.
Work quoted at £250 to £500 a day is generally an automated vulnerability scan with a cover page. That is a legitimate product with legitimate uses, and it is not a penetration test. If a requirement asks for one, the cheaper number is not a saving, because the deliverable will not satisfy the clause and you will buy the test again.
Is a day rate of £400 ever legitimate for penetration testing?
For manual testing by an accredited provider in the UK, rarely. At that level you are usually buying an automated vulnerability scan with a report wrapper, or offshore work at a different cost base. Both are real products. Neither is what a tender clause asking for a penetration test means, so the question to ask is what the deliverable will actually be rather than what it is called.
Why does adding user roles increase the price so much?
Because each role is a separate set of permissions to test, and the interesting findings are usually in the gaps between roles rather than within one. A tester has to check what each role can do, what it can do that it should not at the same level, and what it can reach at a higher level. That is genuinely more work, and it is where access control flaws live.
Can I reduce the day count by giving the tester source code and documentation?
Sometimes, and it usually changes what you get rather than what you pay. Source access tends to move time from discovery into depth, so the count stays similar and the findings improve. It is worth offering for that reason rather than as a cost-saving measure.
Should the report writing be inside the day count or extra?
Either, provided it is stated. What matters is that it is priced somewhere and you know where. A quote that appears cheap per day and excludes write-up and review is not cheap, it is incomplete, and you will find that out at delivery.
Quotes with the day count on them
Every quote we send states the tester-days and how they are split across the scope, because a price without a count cannot be compared with anything. The two fixed-fee tests on this site are priced the same way.