Skip to content
info@rootsektor.de
24/7 emergency: +49 2932 465265-0 Request a pentest quote Report an emergency
Emergency

Contact

Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.de

Mon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline

Request a pentest quote Report an emergency

Penetration testing | Fixed price after scoping

Penetration Testing Cost & Pentest Quote

Penetration testing cost depends on the scope – and you can describe yours in just a few minutes with our scoping wizard. Our team reviews your information, clarifies any open points, and sends you a fixed-price quote that clearly defines scope, methodology, schedule, report, and retest. Your request and our quote are non-binding for you.

Your penetration test includes

  • Quote within 24 hours of scoping (on business days)
  • Fixed price for the agreed scope – no hidden costs or additional charges
  • Free retest of remediated vulnerabilities
  • Report with executive summary, technical details, and CVSS ratings
  • Specific remediation recommendations for every finding
  • Test certificate to present to customers, partners, and auditors
Start scoping now

Explained up front

How the scoping wizard works

The wizard only asks for what we need for a sound cost estimate: you’ll only see questions about the services you select. Rough estimates are fine.

  1. 01 · Contact details

    Who is asking, and where should the quote go? Your name, company, and email address are enough; with a phone number, we can clarify questions faster. If you’d like a non-disclosure agreement in advance, check the box here.

  2. 02 · Select services

    You can choose from all penetration tests and security services – from web applications and the cloud to red teaming. Feel free to select several; we’ll combine everything into one quote. The fixed price, quote within 24 hours, free retest, and test certificate apply to penetration tests and security assessments; dark web monitoring is quoted individually. Incident response & forensics services are not handled through the wizard – in an acute incident, reach us directly via our 24/7 emergency hotline or use Report an Emergency.

  3. 03 · Scope details

    For each selected service, you answer a few short questions, for example about the number of applications, user roles, or IP addresses. You’ll also tell us the reason for the test, your preferred timeframe, and the test environment.

  4. 04 · Review & submit

    The summary shows all your answers; “Edit” takes you back to any step. Submitting does not commit you to anything.

Not sure what you need? In step 2, select “I’m not sure – please advise me” and briefly describe your goal. We’ll suggest the right scope.

Start scoping now
Four steps to your fixed-price quote

Scoping wizard

Describe your scope

Four steps, a few minutes – and the basis for your fixed-price quote. Your information is only transmitted when you submit it, and we treat it confidentially. Please do not enter any passwords or credentials.

Acute security incident? 24/7 emergency hotline +49 2932 465265-0 · Report an emergency (opens in a new tab)

Step 1 of 4: Contact details

Fields marked with * are required.

Your contact details

We need this information to prepare your quote and to clarify any questions quickly. Your entries are transmitted only when you submit the form.

We will send your quote to this address.

For quick questions about the scope – often the fastest way.

How would you like us to contact you?

In that case, general information is enough in step 3. If you wish, we will sign the non-disclosure agreement before any confidential details are exchanged – we are also happy to use your own template.

Which services are you interested in?

Select one or more services. For each one you select, we will ask you a few short questions in the next step – that’s all.

Services

Penetration Testing

Simulated attacks that uncover exploitable vulnerabilities before real attackers do.

Security Services

Assessments, reviews, and simulations that improve your security posture for the long term.

Not sure yet?

No service selected yet

Tip: Attacks often combine several routes – for example, a web application and its API, or the external and internal network. Feel free to select several services; we will combine everything into one quote.

Scope details

Answer the questions as best you can – estimates are fine. Simply leave blank anything you don’t know; we will clarify it together. Please do not enter any passwords or credentials.

You have requested a non-disclosure agreement, so feel free to describe your systems in general terms for now – without URLs, IP addresses, or internal names. We will clarify the details once the agreement has been signed.

Web Applications & Online Shops

The type and size of your applications and the way users access them determine the testing effort.

Fill in only if you selected “Web Applications & Online Shops.”

One line per application with its URL or a short description. If you requested an NDA, a general description is enough.

What matters is dynamic functionality such as forms, search, uploads, or ordering processes – not the number of static pages. If there are several applications, just answer for the largest one.

For example, guest, customer, partner, and administrator. We test each role with its own test accounts – including unauthorized access across role boundaries.

How do users sign in?
Preferred testing perspective

API Penetration Testing

For the quote, the main factors are the technology, the number of endpoints, and the authorization logic.

Fill in only if you selected “API Penetration Testing.”

Which API technology do you use?

For REST, each combination of path and method counts (e.g., GET /orders); for GraphQL, each query and mutation.

Is there any documentation?

A specification speeds up the test considerably. Without one, we identify the endpoints from the application’s traffic.

How do clients authenticate?

To test for Broken Object Level Authorization (BOLA), we need at least two test accounts per role.

Who uses the API?

Mobile Apps (iOS & Android)

Platform, distribution, and backend determine the effort required for an app test.

Fill in only if you selected “Mobile Apps (iOS & Android).”

Which platforms should be tested?

The iOS and Android versions of the same app count as one app.

How is the app distributed?

For the test, we need the app file (IPA or APK/AAB) or a test distribution, e.g., via TestFlight.

Should the backend interface (API) be tested as well?

Many vulnerabilities only become apparent in the interaction between app and server.

Preferred testing perspective

Network & Infrastructure

External, internal, or both – the size and structure of your network determine the effort.

Fill in only if you selected “Network & Infrastructure.”

Which types of test are you interested in?

All addresses reachable from the internet, e.g., web server, mail server, VPN gateway, and firewall. A /28 network comprises 16 addresses.

Servers, workstations, and network devices combined – a rough estimate is enough.

For example, office, server, production, guest, or payment networks.

We perform internal tests either on-site or remotely – via VPN or through a provided test system, such as a virtual machine in your network.

Do you use Active Directory?

In internal tests, Active Directory is a key target. For a more in-depth review, our Active Directory Assessment is a useful addition.

Wireless Penetration Testing

Wireless tests take place on-site. Locations, wireless networks, and authentication methods determine the effort.

Fill in only if you selected “Wireless Penetration Testing.”

From which perspectives should we test?

For example, corporate, guest, warehouse, or IoT Wi-Fi.

Which authentication methods do you use?

This helps us plan the time on-site and the search for unauthorized access points.

Cloud Penetration Testing

The platforms, the number of environments, and the testing perspective determine the scope.

Fill in only if you selected “Cloud Penetration Testing.”

Which cloud platforms should be tested?

Separate environments such as production, staging, and development count individually.

Which services do you mainly use?
Preferred testing perspective

For gray-box and white-box tests, read-only roles such as SecurityAudit (AWS), Reader (Azure), or Viewer (Google Cloud) plus a test identity with typical permissions are usually sufficient.

Do you manage your infrastructure as code?

If you wish, we include IaC templates in the analysis.

Is the cloud connected to your on-premises network?

AI & LLM Penetration Testing

What matters most is the architecture, the data your AI can access, and the actions it is allowed to take.

Fill in only if you selected “AI & LLM Penetration Testing.”

What would you like us to test?
What does the AI have access to?

The more data and tools a model can reach, the greater the potential damage from prompt injection.

Who can use the application?
Which safeguards are already in place?

OT, ICS/SCADA & IoT

In OT environments, availability comes first – which is why we also ask about your operating conditions.

Fill in only if you selected “OT, ICS/SCADA & IoT.”

Which type of test are you interested in?
How may we test?

We perform active tests on controllers only with your approval and in close coordination with operations.

Which interfaces does the device have?

For hardware analyses, we may need several units of the device.

Social Engineering & Physical Testing

We define scenarios, target groups, and boundaries together with you in writing before the test.

Fill in only if you selected “Social Engineering & Physical Testing.”

Which scenarios are you interested in?
Ground rules

Results are evaluated anonymously by default. Before the test, we agree with you on contacts, what is off-limits, and the authorization letter our team carries on-site.

Vulnerability Assessment

What matters most is the type of assessment, the number of systems, and how often the assessment should take place.

Fill in only if you selected “Vulnerability Assessment.”

Which type of assessment are you interested in?
One-time or recurring?

Regular assessments make new vulnerabilities visible early. If you wish, we use Greenbone in your own environment for this.

How should we access the internal network?

Red Teaming & APT Simulation

A red teaming engagement is tailored to your objectives and your security maturity. This information helps us plan it.

Fill in only if you selected “Red Teaming & APT Simulation.”

Which format are you interested in?

We offer purple teaming as a variant of, or complement to, red teaming. We start assumed-breach scenarios either on-site or remotely via VPN or through a provided test system.

Objectives like these (“crown jewels”) make the result measurable. You can also define them during the initial consultation.

Which attack vectors are allowed?
What detection and response capabilities do you have?

This allows us to design scenarios that realistically challenge your detection capabilities.

This gives us a first impression of the size and complexity of your environment.

Is the red teaming engagement part of a TLPT under DORA or TIBER-EU?

Threat-led penetration tests (TLPT) follow a defined process that includes threat intelligence and coordination with the competent authority. We discuss the requirements during the initial consultation.

Active Directory Assessment

The size and structure of your directory determine the effort required for the assessment.

Fill in only if you selected “Active Directory Assessment.”

Which type of assessment are you interested in?

We perform the assessment either on-site or remotely – via VPN or through a provided test system.

Is Active Directory synchronized with Entra ID?
Do you use Active Directory Certificate Services (AD CS)?

Misconfigured certificate templates can enable a takeover of the domain – we include them in our review.

Microsoft 365 & Azure Review

The scope, licenses, and size of your tenant determine the review effort.

Fill in only if you selected “Microsoft 365 & Azure Review.”

Which areas should the review focus on?

Your licenses determine which security features, such as Conditional Access or Microsoft Defender, are available.

Can you provide a review account with read-only roles?

Read-only roles are sufficient for the review – we do not need administrator rights.

AWS Security Review

The number of accounts, your organizational structure, and the services you use determine the scope.

Fill in only if you selected “AWS Security Review.”

Which review focus fits your environment?
Which services do you mainly use?
Should the review be based on a specific standard?
Can you provide a review role with read-only permissions?

We work strictly read-only, using temporary credentials – permanent access keys are not required.

OSINT Assessment

Our research relies exclusively on publicly accessible sources. This information helps us narrow down the assessment.

Fill in only if you selected “OSINT Assessment.”

Which perspective are you interested in?

If you requested an NDA, the number of companies and domains is enough for now.

Before researching individual people, we agree on the data protection aspects with you.

What would you like to use the results for?

Security Awareness & Phishing Simulation

Formats, target groups, and the number of participants determine scope and effort.

Fill in only if you selected “Security Awareness & Phishing Simulation.”

Which formats are you interested in?
How often?
Do you need content in languages other than German?
Is there a works council or staff council?

For phishing simulations, we work with you to involve the works or staff council and data protection officers at an early stage and provide the information they need. We conclude a data processing agreement (DPA) as standard.

Dark Web Monitoring

We offer dark web monitoring on an individual basis – we agree on the search profile, scope, and term with you. This information helps us with an initial assessment.

Fill in only if you selected “Dark Web Monitoring.”

What are you interested in?
What else should be included in the search profile?

We add search terms relating to individuals only after the data protection aspects have been agreed.

Please state the role only – we will agree on contact details later.

Code Review & Reverse Engineering

The type and size of the software determine the effort required for a code or binary analysis.

Fill in only if you selected “Code Review & Reverse Engineering.”

Which service are you interested in?

A rough estimate is enough, e.g., determined with a tool such as cloc.

How can you provide the code or software?

We will agree on a secure way to exchange it with you once the engagement has been confirmed.

Your project

Briefly describe what you would like to achieve – we will suggest the right scope.

Fill in only if you selected “I’m not sure – please advise me.”

Which areas are involved?
How would you like to receive advice?

For advice by phone, please enter your phone number in step 1.

General information

This information applies to all selected services.

Is there a specific reason or compliance driver?

You can select more than one. We align the scope and report with the evidence you need.

In which environment should we test?

Testing in production is possible – we agree on time windows and precautions with you. If the environment differs from service to service, please note this under “Comments.”

Are there any restrictions on testing times?
Has a penetration test been carried out before?

Please do not enter any passwords, credentials, or confidential documents.

Review and submit

Please check your information. Use “Edit” to jump back to the relevant step – your entries are kept.

Incomplete? No problem. We will clarify any open points with you personally after you submit – by email or phone.

We use your information solely to process your request and prepare a quote for you. Your data is transmitted in encrypted form. For more information, please see our Privacy Policy (opens in a new tab).

Transparent fixed prices

What affects your penetration testing cost?

Pentest prices aren’t list prices: what matters is how much testing time your systems need for a reliable result. That’s why we clarify the scope first – and you know the fixed price before the first test begins.

The key pricing factors

The same type of test can take a few days or several weeks, depending on the environment. Four factors make the biggest difference:

  • Scope: number of applications, API endpoints, IP addresses, devices, user accounts, sites, or employees
  • Complexity: user roles, business processes, interfaces, network segmentation, and the technologies in use
  • Access: testing with or without authentication, test or production environment, available documentation and test accounts
  • Constraints: dates and deadlines, on-site work, test windows outside business hours, and compliance and reporting requirements

What your fixed-price quote includes

You don’t get a bare price tag but a written quote that describes exactly what we test and how. This lets you compare quotes from different providers fairly – by testing depth rather than price alone.

  • Test objects, objectives, and exclusions of the agreed scope
  • Approach and methodology – based on standards such as OWASP, PTES, or the penetration testing concept published by the BSI (Germany’s Federal Office for Information Security) – with estimated effort, assumptions, and possible dates
  • A fixed price that is set before testing begins: no hidden costs, no additional charges for the agreed scope
  • Report, an optional debriefing, free retest, and test certificate

Estimated by people: The wizard only collects the key data. A penetration tester from our team estimates the effort – and follows up if any information isn’t sufficient for a reliable estimate.

Request a fixed-price quote

Preparing your scope

What information helps us prepare your quote?

The better we know your environment, the more accurately the fixed price reflects the actual effort. We don’t need a complete inventory list for this – depending on the service, the following information is particularly helpful.

  • Web, mobile, API & AI

    Applications & APIs

    For app and interface tests, we need to understand what the application does and who uses it and how.

    • URLs, API documentation (e.g., OpenAPI), number of endpoints or app platforms
    • Technologies, frameworks, connected third-party systems, and backend
    • Login, single sign-on, MFA, user roles, and account types

  • Infrastructure & identities

    Networks & cloud

    For infrastructure and cloud, the size, architecture, and required access determine the effort.

    • External IP addresses, internal subnets, VLANs, sites, and network zones
    • Firewalls, VPN access, web application firewalls, and segmentation
    • Cloud providers, accounts, subscriptions or projects, and the services in use

  • Social engineering, OT & IoT

    People & specialized tests

    For tests involving people, buildings, or industrial facilities, we define goals and boundaries before we prepare a quote – this protects your operations and your employees.

    • Number of employees or sites, target groups, and desired scenarios
    • Permitted techniques, measurable objectives, and planned awareness measures
    • Sensitive individuals, areas, or facilities, maintenance windows, and other exclusions

  • For every request

    Goals, compliance & schedule

    Knowing the reason for the test lets us recommend the right one – and structure the report so that it holds up as evidence for auditors, customers, or insurers.

    • Requirements from ISO/IEC 27001, NIS2, DORA, TISAX, PCI DSS 4.0.1, or from customers
    • Preferred timeframe, on-site work, and restrictions on testing times
    • Previous tests or incidents and special reporting requirements

Have documents at hand? Architecture diagrams, API specifications, or previous test reports speed up the estimate. Please don’t send such documents via the wizard – if needed, we’ll agree on a secure exchange with you.

Start scoping

Process

From quote to reliable results

Four steps with clear agreements and a dedicated point of contact at Rootsektor – you always know what happens next.

  1. 01

    Scoping

    You fill out the scoping wizard or talk to us directly. We review your information and clarify open questions – on request, we sign a non-disclosure agreement with you beforehand.

  2. 02

    Fixed-price quote

    Within 24 hours of scoping (on business days), you’ll receive your written quote with scope, methodology, effort, assumptions, and possible dates.

  3. 03

    Penetration test

    We test according to rules of engagement agreed in writing – scope, testing times, contacts, and off-limits areas are defined in advance. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.

  4. 04

    Remediation & retest

    You receive the report with an executive summary, technical details, and remediation recommendations; on request, we discuss the results together. We retest remediated vulnerabilities free of charge, and the test certificate lets you demonstrate the test to customers, partners, insurers, and auditors.

Related pages

FAQ

Frequently asked questions about your pentest quote

Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.

Is my request via the scoping wizard binding?

No. Submitting it does not create any obligation – neither your request nor our quote is binding on you. Only once you accept the fixed-price quote do we plan the penetration test together with you. Until then, you can adjust the scope and schedule at any time.

How quickly will I receive my fixed-price quote?

Within 24 hours of scoping, on business days. If the information from the scoping wizard is sufficient for a reliable estimate, we prepare the quote right away. If something is still missing, we’ll get in touch with a quick question by phone or email and complete the scoping together with you. This commitment – like the fixed price, free retest, and test certificate – applies to penetration tests and security assessments; for dark web monitoring and incident response & forensics services, we prepare an individual quote.

Can we sign a non-disclosure agreement (NDA) before scoping?

Yes, of course. Check the NDA box in the scoping wizard and describe your systems only in general terms at first – we’ll clarify details such as URLs or IP ranges after signing. On request, we sign the non-disclosure agreement before scoping – based on your own template, if you prefer.

What if I don’t know which test I need?

No problem – many organizations are in the same position, especially before their first penetration test. In the wizard, select “I’m not sure – please advise me” and briefly describe your goal, such as a customer’s testing requirement, an upcoming ISO 27001 audit, or the launch of a new application. We’ll then recommend the right scope and a suitable testing perspective. Or call us directly: +49 2932 465265-0.

How long does a penetration test take – and when can it start?

The duration depends on the scope: a single application with a few roles can be tested faster than a network with several sites or a red teaming engagement. Your quote already states the estimated effort and possible dates, so enter your preferred timeframe and fixed deadlines such as audit dates in the wizard. Also allow some lead time for test accounts, internal approvals, and, if necessary, coordination with your hosting provider. We carry out remote tests without travel time – in Germany and internationally; for on-site engagements, we factor travel into the schedule.

What is included in the fixed price – and what isn’t?

Everything defined as the scope in the quote is included: preparation, execution, a report with executive summary and remediation recommendations, an optional debriefing, the free retest of remediated vulnerabilities, and the test certificate. There are no additional charges for the agreed scope. If you want to expand the test later, for example to additional systems, you’ll receive a separate quote for this in advance.