Penetration Test Scope & Cost Estimator

ANA›Life Services Authority›National Calculator Authority›Penetration Test Scope & Cost Estimator

.calc-container { max-width: 640px; margin: 2rem 0; padding: 1.5rem; background: #fff; border: 1px solid #ddd; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,0.06); font-family: system-ui, -apple-system, sans-serif; } .calc-container h3 { font-family: Georgia, serif; font-size: 1.15rem; color: #1a1a1a; margin-bottom: 1rem; padding-bottom: 0.5rem; border-bottom: 2px solid var(--ac, #3d5a80); } .calc-row { display: flex; align-items: center; gap: 0.75rem; margin-bottom: 0.75rem; flex-wrap: wrap; } .calc-row label { min-width: 160px; font-size: 0.9rem; color: #333; font-weight: 500; } .calc-row input[type="number"], .calc-row select { flex: 1; min-width: 120px; max-width: 200px; padding: 0.5rem 0.6rem; border: 1px solid #ccc; border-radius: 4px; font-size: 0.9rem; font-family: system-ui, sans-serif; color: #1a1a1a; background: #fafaf8; } .calc-row input:focus, .calc-row select:focus { outline: none; border-color: var(--ac, #3d5a80); box-shadow: 0 0 0 2px rgba(26,74,138,0.12); } .calc-row .unit { font-size: 0.82rem; color: #888; min-width: 30px; } .calc-btn { display: inline-block; margin-top: 0.5rem; padding: 0.55rem 1.5rem; background: var(--ac, #3d5a80); color: #fff; border: none; border-radius: 4px; font-size: 0.9rem; font-weight: 600; cursor: pointer; font-family: system-ui, sans-serif; } .calc-btn:hover { opacity: 0.9; } .calc-result { margin-top: 1.25rem; padding: 1rem 1.25rem; background: #f0f6fc; border-left: 3px solid var(--ac, #3d5a80); border-radius: 0 6px 6px 0; display: none; } .calc-result.visible { display: block; } .calc-result-label { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: #666; margin-bottom: 0.25rem; } .calc-result-value { font-size: 1.6rem; font-weight: 700; color: var(--ac, #3d5a80); } .calc-result-detail { font-size: 0.85rem; color: #555; margin-top: 0.5rem; line-height: 1.5; } .calc-note { margin-top: 1rem; font-size: 0.8rem; color: #888; font-style: italic; } .calc-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 0.75rem; margin-top: 0.75rem; } .calc-grid-item { padding: 0.6rem 0.8rem; background: #f8f9fa; border-radius: 4px; border: 1px solid #eee; } .calc-grid-item .label { font-size: 0.75rem; color: #888; text-transform: uppercase; letter-spacing: 0.04em; } .calc-grid-item .value { font-size: 1.1rem; font-weight: 600; color: #1a1a1a; } @media (max-width: 720px) { .calc-row { flex-direction: column; align-items: flex-start; gap: 0.3rem; } .calc-row label { min-width: auto; } .calc-row input[type="number"], .calc-row select { max-width: 100%; width: 100%; } .calc-grid { grid-template-columns: 1fr; } } .calc-chart { margin: 1rem 0; text-align: center; } .calc-chart svg { max-width: 100%; height: auto; } .calc-chart-legend { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.6rem 1.2rem; margin-top: 0.6rem; font-size: 0.8rem; color: #555; } .calc-chart-legend span { display: inline-flex; align-items: center; gap: 0.3rem; } .calc-chart-legend i { display: inline-block; width: 10px; height: 10px; border-radius: 2px; font-style: normal; } .calc-related { max-width: 640px; margin: 2rem 0 1rem; padding: 1.25rem 1.5rem; background: #f8f9fa; border: 1px solid #e8e8e8; border-radius: 8px; } .calc-related h3 { font-family: Georgia, serif; font-size: 1rem; color: #1a1a1a; margin: 0 0 0.75rem; padding-bottom: 0.4rem; border-bottom: 2px solid var(--ac, #3d5a80); } .calc-related-list { list-style: none; padding: 0; margin: 0 0 0.75rem; display: grid; grid-template-columns: 1fr 1fr; gap: 0.4rem 1.5rem; } .calc-related-list li a { font-size: 0.88rem; color: var(--ac, #3d5a80); text-decoration: none; } .calc-related-list li a:hover { text-decoration: underline; } .calc-browse-all { margin: 0.5rem 0 0; font-size: 0.9rem; font-weight: 600; } .calc-browse-all a { color: var(--ac, #3d5a80); text-decoration: none; } .calc-browse-all a:hover { text-decoration: underline; } @media (max-width: 720px) { .calc-related-list { grid-template-columns: 1fr; } }

Penetration Test Scope & Cost Estimator

Estimates the effort (days) and cost range for a penetration test based on your environment size, asset types, and engagement parameters.

Engagement Type

External Network Internal Network Web Application Mobile Application Red Team / Full Scope

Number of In-Scope IP Addresses / Hosts (0 if N/A)

Number of Web / Mobile Applications (0 if N/A)

Number of API Endpoints (0 if N/A)

Environment Complexity

Low – Simple / flat network, few technologies Medium – Mixed technologies, some segmentation High – Complex segmentation, cloud, OT/IoT, legacy systems

Number of Distinct Authentication / Role Levels

Report Type Required

Executive Summary Only Standard Technical Report Detailed Remediation + Retest Included

Consultant Day Rate (USD)

Estimate Scope & Cost Results will appear here.

function penCalc() { // --- Read inputs --- const engagementType = document.getElementById('pen-engagement-type').value; const numIPs = parseFloat(document.getElementById('pen-num-ips').value) || 0; const numApps = parseFloat(document.getElementById('pen-num-apps').value) || 0; const numEndpoints = parseFloat(document.getElementById('pen-num-endpoints').value) || 0; const complexity = document.getElementById('pen-complexity').value; const authLevels = parseFloat(document.getElementById('pen-auth-levels').value) || 1; const reportType = document.getElementById('pen-report-type').value; const dayRate = parseFloat(document.getElementById('pen-tester-rate').value); const resultDiv = document.getElementById('pen-result');

// --- Validation --- const errors = []; if (numIPs 10000) errors.push("IP count must be between 0 and 10,000."); if (numApps 500) errors.push("Application count must be between 0 and 500."); if (numEndpoints 5000) errors.push("Endpoint count must be between 0 and 5,000."); if (authLevels 20) errors.push("Auth levels must be between 1 and 20."); if (isNaN(dayRate) || dayRate 10000) errors.push("Day rate must be between $500 and $10,000.");

if (errors.length > 0) { resultDiv.innerHTML = 'Input Errors:' + errors.join('') + ''; return; }

// --- Base effort by engagement type (tester-days) --- // Industry benchmarks: CREST / PTES / OWASP testing guide estimates const baseEffort = { external: 3, // External network baseline internal: 5, // Internal network baseline webapp: 4, // Web app baseline mobile: 4, // Mobile app baseline redteam: 10 // Red team baseline };

let effortDays = baseEffort[engagementType];

// --- IP / Host scaling --- // Rule of thumb: ~0.05 days per host for external; ~0.08 days per host for internal const ipScaleFactor = (engagementType === 'internal' || engagementType === 'redteam') ? 0.08 : 0.05; effortDays += numIPs * ipScaleFactor;

// --- Application scaling --- // OWASP WSTG: ~2 days per average web application effortDays += numApps * 2.0;

// --- API endpoint scaling --- // ~0.1 days per endpoint (discovery, auth testing, injection, logic) effortDays += numEndpoints * 0.10;

// --- Complexity multiplier --- const complexityMultiplier = { low: 0.80, medium: 1.00, high: 1.40 }; effortDays *= complexityMultiplier[complexity];

// --- Authentication / role levels --- // Each additional role level beyond 1 adds ~0.5 days (privilege escalation paths) effortDays += (authLevels - 1) * 0.5;

// --- Report overhead --- const reportOverhead = { summary: 0.5, standard: 1.5, detailed: 3.0 }; effortDays += reportOverhead[reportType];

// --- Round to nearest half-day --- effortDays = Math.round(effortDays * 2) / 2;

// --- Cost calculation --- // Low estimate: 1 tester; High estimate: 1.3x (senior tester premium / travel / tooling) const costLow = effortDays * dayRate; const costHigh = effortDays * dayRate * 1.30;

// --- Complexity label --- const complexityLabel = { low: 'Low', medium: 'Medium', high: 'High' }; const engagementLabel = { external: 'External Network', internal: 'Internal Network', webapp: 'Web Application', mobile: 'Mobile Application', redteam: 'Red Team / Full Scope' }; const reportLabel = { summary: 'Executive Summary Only', standard: 'Standard Technical Report', detailed: 'Detailed + Retest' };

// --- Risk / scope tier --- let scopeTier, scopeColor; if (effortDays '$' + n.toLocaleString('en-US', {minimumFractionDigits: 0, maximumFractionDigits: 0});

resultDiv.innerHTML = ` ### 🔐 ${scopeTier}

Engagement Type ${engagementLabel[engagementType]}

In-Scope IPs / Hosts ${numIPs}

Applications ${numApps}

API Endpoints ${numEndpoints}

Environment Complexity ${complexityLabel[complexity]}

Auth / Role Levels ${authLevels}

Report Type ${reportLabel[reportType]}

Consultant Day Rate ${fmt(dayRate)}

Estimated Effort ${effortDays} tester-days

Estimated Cost Range ${fmt(costLow)} – ${fmt(costHigh)} Low = base rate × days  |  High includes 30% senior/travel/tooling premium

⚠ Note: This is a planning estimate only. Final scope and pricing should be confirmed with a qualified penetration testing firm after a formal scoping call and statement of work.

`; }

#### Formula

Effort (days) = Basetype + (IPs × IPscale) + (Apps × 2.0) + (Endpoints × 0.10) × Complexitymultiplier + (AuthLevels − 1) × 0.5 + Reportoverhead

Cost Low = Effort × DayRate Cost High = Effort × DayRate × 1.30

Parameters:

#### Assumptions & References

More Calculators

Read Next

Study Time Planner Authority Network America › Life Services Authority › National Calculator Authority .calc-container { max-width: 640px;...

References

Related Authorities

Life Services Authority › Professional Services Authority › Trade Services Authority › United States Authority ›