What does a penetration test cost roughly?

For a single web application, quotes typically start in the low thousands, depending on scope and depth. For more complex environments it climbs from there.

How often should I run a scan like this?

After every notable change to your site, and periodically beyond that. Secrets usually leak via a deploy, so the moment just after a release is the most useful one.

Does this satisfy a certification or a client requirement?

No. Frameworks such as ISO 27001 ask for demonstrable processes, not a scan report. The report can serve as evidence that you check periodically.

No budget for a pentest? Start here.

A full penetration test quickly costs several thousand, and produces a report that is valid for weeks. For a small business with a website and a shop that is often not feasible — and sometimes not the right first answer either. Because a penetration tester opens their engagement with precisely the things an automated scan also finds. Better to make sure they no longer find them.

Lees deze pagina in het Nederlands

Run free audit

Be honest: this does not replace a pentest

Let us be clear about that up front. A penetration tester thinks. They combine three individually harmless weaknesses into one working attack, they try to abuse the business logic of your checkout, they see what happens when they skip a step. No scanner does that, and anyone claiming otherwise is selling you an illusion.

What a scan does do is find the known, measurable problems — and in practice there are a surprising number of those. Clear them first and you stop paying a tester to write down things a script could have seen.

What this catches for you

The categories a scan is strong at overlap with the opening pages of virtually every pentest report:

Credentials and API keys that hitched a ride into your frontend
Config and backup files sitting publicly retrievable
Missing security headers and a CSP that stops nothing
Clickjacking and mixed content
CORS that admits any origin
Server versions and technology given away unnecessarily
TLS configuration and expiring certificates
Email security: SPF, DKIM and DMARC, which stop somebody mailing on behalf of your domain

A sensible order

Run the scan first and fix what comes out. Then run it again to confirm the fixes actually landed — which is less often the case than you would think, especially for headers set at the wrong layer.

Only once that is clean, and only if you have something worth protecting, do you hire a penetration tester. You will get more for your money, because their time goes to the things only a human finds. Do you process payments, store medical or financial data, or has a client made it a contractual requirement? Then a pentest is not a luxury and you should not try to work around it.

Why email security is in here too

A lot of small-business damage does not start at the website but at the mailbox. Without correctly configured SPF, DKIM and DMARC, somebody can send mail that appears to come from your domain — an invoice with an altered bank account, for instance. That is cheap to fix and structurally overlooked, so the audit checks your DNS records for it as well.

Frequently asked questions

What does a penetration test cost roughly?: For a single web application, quotes typically start in the low thousands, depending on scope and depth. For more complex environments it climbs from there.
How often should I run a scan like this?: After every notable change to your site, and periodically beyond that. Secrets usually leak via a deploy, so the moment just after a release is the most useful one.
Does this satisfy a certification or a client requirement?: No. Frameworks such as ISO 27001 ask for demonstrable processes, not a scan report. The report can serve as evidence that you check periodically.

Curious what is on your own site? Paste a URL and you have a report within a minute.

Run free audit