Key Takeaways
- Most small business external tests typically run a few thousand dollars, while larger multi-site tests cost much more.
- Price follows scope: how many IP addresses, web apps, user roles, locations and test days are included.
- A cheap quote that is only an automated scan is not a penetration test.
- Retesting after fixes should be priced in the quote, not added later.
- Ask for a sample report and a written scope before you sign anything.
If you are shopping for a penetration test, the first quotes you get can look wildly different. One firm says a few thousand dollars. Another says five times that. Both may be honest. A penetration test is custom work, and the price follows the scope. Penetration testing is one piece of a wider cybersecurity program, and it helps to know where it fits before you compare numbers.
This guide breaks pricing down by what is being tested: your outside network, your inside network, a web application, wireless, and your staff. For each, you will see what typically drives the cost in the Chicago market. All ranges here are typical, not quotes. Your scope decides your number.
You will also see how to read a proposal, which line items to question and which mistakes make a test look cheaper than it is. You do not need to be technical to use this. You only need to ask the right questions.
What You Are Actually Paying For
A penetration test is a person, or a small team, trying to break into your systems the way a real attacker would, with your written permission. You are paying for skilled hours. Most of the cost is the tester’s time, plus planning, reporting and a call to walk through the results.
That is why scope matters more than company size. A 15-person firm with one office and one cloud login may be a short job. A 15-person firm with a custom customer portal, three offices and a warehouse network is a much bigger one. Testers price by the number of things to examine and the depth you ask for.
- Tester time for scoping, testing and writing the report
- Senior review of findings so nothing is overstated or missed
- A readout call where you can ask questions
- Retesting after you fix the problems, if included
- Insurance and legal paperwork that protects both sides
Most of a test’s price is human hours, so a bigger scope means more days on the job.
Typical Price Ranges by Test Type
Prices below are typical ranges for Chicago-area small and mid-sized businesses. They shift with your environment and the depth of testing. Treat them as a way to spot a quote that is far too low or far too high.
| Test type | What it covers | Typical range | Typical time |
|---|---|---|---|
| External network | Internet-facing systems, firewalls, VPN, mail servers | $3,000 to $10,000 | 3 to 6 days |
| Internal network | What an attacker could reach once inside your office or via a stolen laptop | $5,000 to $15,000 | 4 to 8 days |
| Web application | One custom site or portal, including logins and user roles | $5,000 to $20,000 | 5 to 10 days |
| Wireless | Office Wi-Fi, guest network separation, rogue access points | $2,500 to $7,000 | 2 to 4 days |
| Social engineering | Phishing and phone tests against your staff | $2,000 to $8,000 | 1 to 3 weeks |
| Cloud configuration | Microsoft 365, Azure or AWS settings and permissions | $4,000 to $12,000 | 3 to 7 days |
Bundles usually cost less than buying each test alone, because planning and reporting are shared. A combined external and internal test often lands in the low to mid teens for a small business.
The Factors That Move the Quote
Two businesses with the same headcount can get very different quotes. These are the usual reasons.
- Number of targets. Counting live IP addresses, servers and apps tells the tester how much ground there is to cover.
- Locations. A Loop office plus a branch in Evanston and a warehouse near O’Hare means more networks to test and more travel or remote setup.
- Web app complexity. A brochure site is cheap to test. A portal with several user roles, payments and file uploads takes far longer.
- Depth of testing. Finding a weakness is one level. Safely proving what an attacker could reach with it is deeper, and costs more.
- Timing. Testing outside business hours or on short notice can add to the price.
- Reporting needs. Reports written for a lender, insurer or auditor take more effort than an internal summary.
Each extra office or network zone you add to the scope typically adds a day or more of testing.
Penetration Test vs. Vulnerability Scan Pricing
Many low quotes are really scans with a nicer cover page. A scan uses software to look for known weaknesses. It is useful, cheap and fast. A penetration test adds a human who tries to chain those weaknesses together and see what is truly reachable. If you only need a regular health check, a vulnerability assessment may fit your budget and your goal better.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated software | Skilled human, using tools |
| Typical cost | A few hundred to a few thousand dollars | Several thousand dollars and up |
| Output | List of possible weaknesses | Proven attack paths and fixes ranked by risk |
| False positives | Common | Checked by the tester |
| Best for | Routine checks, monthly or quarterly | Annual proof, insurer or customer requests |
Neither replaces the other. Many Chicago businesses scan often and run a full test once a year. When someone quotes you a penetration test at scan prices, ask to see the methodology.
Real Examples of Scope & Price
These are illustrative examples of how scope shapes cost. They are not real clients.
A 12-person law office in the Loop
One office, Microsoft 365, a VPN and a firewall. An external test plus a phishing exercise is a reasonable starting point. This kind of scope typically lands in the mid single-digit thousands.
A 40-person distributor near O’Hare
Two networks, a warehouse system, scanners and a customer ordering portal. External, internal and web app testing together is a larger job. Expect a range well into five figures.
A multi-location medical group
Several offices, patient data and a regulatory expectation for regular risk review. Testing is often paired with a cybersecurity consulting engagement so findings turn into a real work plan, not just a report.
A single-office external test often needs only a few days, since there is one firewall and one set of public addresses.
How to Read a Penetration Testing Proposal
A good proposal is short and specific. A weak one is vague and heavy on jargon. Look for these items before you compare price.
- A written scope that names the systems, locations and apps in and out of bounds
- The number of testing days, not just a flat fee
- Who does the work and their experience
- What the report contains, with a sample you can read first
- Rules of engagement, including testing windows and emergency contacts
- Whether one round of retesting is included
- How findings are explained to non-technical staff
Red flags include a fixed price with no scope, no named tester, a guarantee that nothing will be found, and pressure to sign fast. A test that finds nothing is not a clean result if the scope was thin.
Ways to Keep the Cost Down Without Cutting Value
You do not need to test everything. You need to test what matters most. Start by listing where your sensitive data lives and which systems face the internet. Tighten the scope around those. Fix obvious problems first, such as missing updates and weak passwords, so paid hours go to harder questions. Regular patching through managed security services makes each future test shorter and cheaper, because there is less low-hanging fruit to report.
Also ask about a multi-year relationship. Some firms discount repeat annual tests because they already know your environment. Spending a little time on a clean network diagram and an asset list before the test starts can save billable hours, too.
Ranking systems by data sensitivity before scoping often trims a test by a day or two.
Where Testing Fits in Your Security Budget
Testing is a point-in-time check. It tells you how you look today. It does not protect you tomorrow. Budget for the fixes that follow, since the report is only useful if someone acts on it. A common split for a small business is a modest yearly test plus steady spending on monitoring, patching and training.
If you are building a full budget, see our breakdown of what small business cybersecurity costs in Chicago. If you are not sure where to start, a cybersecurity checklist shows which basics to cover before paying for a test. Many insurers and customers now ask for proof of testing, so confirm what they will accept before you buy. To learn more about how the service itself works, read about penetration testing in Chicago.
The right test is the one that matches what you actually need to protect. A small office with one network does not need the same engagement as a distributor with a customer portal. Start with scope, ask for days and deliverables in writing, and be wary of any price that arrives before anyone has asked about your systems.
Your next step is simple. Write down your locations, your key apps and where sensitive data sits. Bring that list to a free IT assessment, and you will leave with a clear scope, a realistic range and a plan for which tests to buy first.
FAQs
How much does a penetration test cost in Chicago?
Most small businesses typically pay between about $3,000 and $15,000 for a focused test, depending on scope. External network tests sit at the lower end. Internal, web application and multi-location tests cost more. Only a written scope gives you a firm price.
Why do penetration testing quotes vary so much?
Quotes differ because firms scope differently. One may include retesting and a senior review, another may not. Some quotes are really automated scans. Compare the number of testing days, the named systems and the report sample, not just the final price.
Is a vulnerability scan the same as a penetration test?
No. A scan is automated and lists possible weaknesses. A penetration test uses a skilled person who tries to exploit them and shows what an attacker could really reach. Scans cost less and run often. Tests go deeper and are usually done yearly.
How often should a small business get a penetration test?
Most businesses test once a year, and again after major changes such as a new office, a new app or a move to the cloud. Your insurer, customers or regulators may also set a schedule. Ask them what they expect before you plan.
Does the price include fixing the problems?
Usually not. A test finds and explains problems. Fixing them is separate work, done by your IT team or provider. Ask whether one round of retesting is included so you can confirm fixes worked without paying a second full fee.
Reid Callahan
Editorial Director, Ping Chicago
Reid leads the Ping Chicago editorial team and works with our technicians to turn real support tickets, office moves and security reviews into plain-English guides for Chicago business owners. Born and raised in Chicago, he has spent more than 15 years in IT services, starting on the help desk and later running support and network projects for law firms, medical practices and manufacturers from the Loop to the western suburbs. He holds Microsoft 365 and CompTIA Security+ certifications and has helped hundreds of local offices move to the cloud. Today he focuses on how AI tools like Microsoft Copilot can save small teams time without putting company data at risk, and every guide he writes is checked by a working technician before it goes live.