External network
$8,500 typical · up to 15 IPs
PT-EPT-01. Exploitable findings plus retest window and letter.
GPEN · GWAPT · if the quote has no retest, you bought a scan
A penetration test with a named surface and a retest.
Examiners and insurers still ask for a test. A scan-only PDF is not one. Quotes name the surface, the rules of engagement, and a retest window.
Internal network
$9,500 typical · one site
PT-IPT-01. Agreed vantage point. Extra site quoted.
Web application
$7,500 one app
PT-WPT-01 · GWAPT. Additional app $4,000. Authenticated where agreed.
Combined external + internal: $15,500 typical, one report, one retest. Verification retest of our findings within 90 days: $2,200. Point-in-time external scan + letter (not a test): $1,800 — prefer Baseline if you need this every month.
GIAC GPENGIAC GWAPT