Penetration testing cost in Australia: how scope, tester days and retests set the price

A penetration test is usually quoted as a fixed price for a defined scope, but behind that price is an estimate of tester days multiplied by a day rate, plus reporting and project management. Scope is the biggest driver: the number of internet-facing addresses, the size and number of user roles in a web application, the size of the internal network and whether cloud configuration is included. In the illustrative example below, a combined external, internal and web application test for a mid-sized business is about 15 tester days, or $27,000 ex GST, while a focused external test is about $7,200. A cheap quote is often a smaller scope or an automated scan sold as a test.

This guide sits under the pricing overview. Before any test starts, read pen-test authorisation and the Criminal Code. Figures are illustrative, ex GST.

Types of test and what they answer

Test type	Question it answers	Main scope driver
Vulnerability scan	Which known weaknesses do automated tools find?	Number of addresses; usually software-driven
External network penetration test	Can an attacker on the internet get in?	Number of public IP addresses and services
Internal network test	If an attacker gets a foothold, how far can they go?	Number of network segments, servers, Active Directory size
Web application test	Can users or outsiders abuse the application?	Number of pages, functions, user roles and APIs
Cloud configuration review	Are cloud accounts and services set up securely?	Number of accounts, subscriptions and services
Phishing or social engineering test	Will staff give away access?	Number of staff and scenarios
Red team exercise	Can a skilled attacker reach a goal without being noticed?	Duration and objectives; usually for larger organisations

A vulnerability scan is useful and cheap, but it is not a penetration test. In a real test a person tries to chain weaknesses together and confirms what can actually be exploited. Ask each provider to state how much of the work is manual.

How the price is built: an illustrative scoping

A 70-person business with 12 public IP addresses, an internal network with Active Directory and a customer portal with two user roles.

Component	Tester days	At $1,800 a day
External network test	3	$5,400
Internal network test	4	$7,200
Web application test (2 roles, API)	6	$10,800
Reporting, debrief and project management	2	$3,600
Total	15	$27,000
Retest of fixed findings (optional)	2	$3,600

A focused external test (3 days testing plus 1 day reporting) would be 4 × $1,800 = $7,200. If the business only needs assurance for its internet-facing systems this year, that may be the best fit, with an internal test next year.

Day rates vary with seniority and specialisation. The point is to compare days and scope, not just the final number. If one quote is half the price of another for the same scope, ask how many days each assumes and how much is automated.

What should be in a pen-test proposal

The exact scope: IP addresses, URLs, user roles, environments (production or test), cloud accounts.
The testing approach: black box (no information), grey box (some credentials) or white box (full information). Grey box is a common choice for business applications.
Dates and testing windows, including whether testing happens out of hours.
Rules of engagement: what is off limits (for example denial-of-service), how the tester stops if something breaks, and who to call.
Data handling: how any data the tester accesses is protected and deleted.
Deliverables: an executive summary, technical findings with risk ratings and evidence, and fix recommendations.
Retest terms: included or extra, and for how long after the report.
Written authorisation from someone entitled to give it, covering third-party systems where needed.

How often, and when

Common triggers for a test are a new system going live, a major change, a customer or insurer requirement, and an annual assurance cycle. A sensible pattern for many SMBs is an external test every year and an internal or application test every year or two, with vulnerability scanning in between. Testing more often than you can fix findings is wasted money: budget remediation time with the test.

Comparing quotes fairly

Normalise scope. Write the scope yourself and send the same document to every provider.
Ask for days by component. It reveals where the effort goes.
Check the testers. Ask for anonymised sample reports and the experience of the people who will do the work, not just the company.
Price the retest. A quote without a retest can cost more in the end.
Avoid conflicts. If the same provider manages your security, an independent tester gives a more credible result.

Frequently asked questions

How long does a penetration test take?

For a small to mid-sized scope, testing typically takes from a few days to two or three weeks, with the report following soon after. The proposal should give dates.

Can testing break my systems?

It can disrupt fragile systems. Good testers agree rules of engagement, avoid destructive tests unless agreed and stop if something goes wrong. Have a contact available and recent backups.

Do I need a pen test for the Essential Eight?

The Essential Eight is a set of mitigation strategies with maturity levels, not a testing standard. A test can help confirm controls work, but a maturity assessment is a different exercise. See Essential Eight uplift.

Is the GST on a pen test claimable?

A GST-registered business buying the test for its business can usually claim the GST as an input tax credit. Check with your tax agent.

Sources

ASD's Australian Cyber Security Centre — guidance on vulnerability management and system hardening
Federal Register of Legislation — Criminal Code Act 1995, Part 10.7 (computer offences)
business.gov.au — cyber security resources for business