The main pricing factors
The quote depends on the number of applications and APIs, user roles, critical user flows, technologies, available documentation and the expected level of evidence. Access to the code or the architecture can speed up some checks without reducing depth.
- Number of targets, APIs and environments
- Authentication, SSO, roles and tenant isolation
- Payments, sensitive data and business logic
- Executive report, technical detail and retest
Why prices vary so much
A scanner sold as a pentest does not cost the same as a multi-day engagement led by an expert. Compare the time spent, the tests actually performed, the level of validation, the quality of the report and the support after delivery.
How to keep the budget under control
Fix the alerts that automation can catch first, provide clear documentation and limit the scope to the user flows that truly matter. The expert can then spend their time on business risks rather than on configuration errors that have already been identified.