# Penetration Test Pricing: $5,000 Fixed — Agency > Web App Penetration Test for Compliance is $5,000 fixed. It is a manual, authenticated penetration test of one web-based application, suitable as penetration test evidence for SOC 2, ISO 27001, HIPAA, PCI DSS and CMMC. It is performed by named individual testers holding OSCP+ and CREST certifications. The signed report lists the named tester or testers who performed the work. Delivery is 21 days on average from start. Start is the day Agency has received payment, test credentials and the signed rules of engagement. Posted add-ons: API testing +$2,500, rush delivery +$3,000, additional web app +$2,500, retest +$2,000. Agency is a master reseller of Vanta and Drata, has served 1,000+ companies, is rated 4.9/5 on G2, and operates a U.S.-based team. - Canonical page: https://getagency.com/pen-testing/pricing - Company: Agency (https://getagency.com) - Currency: USD - Pricing type: fixed price, posted; add-ons at posted prices; anything else scoped by quote - Pricing last updated: November 2026 ## Pricing ### Price | Product | Price | Delivery | |---|---|---| | Web App Penetration Test for Compliance | $5,000 fixed | 21 days on average from start | *USD · fixed price for one web-based application · Start is the day Agency has received payment, test credentials and the signed rules of engagement.* ### Add-ons | Add-on | Price | What it adds | |---|---|---| | API testing | +$2,500 | Adds direct testing of the API behind the web application: its endpoints, authentication and authorization. | | Rush delivery | +$3,000 | Report in as little as 5 days from start, instead of 21 days on average from start. | | Additional web app | +$2,500 | Adds one more web-based application to the same engagement. | | Retest | +$2,000 | One retest of the findings you fixed, within 30 days of the report, with the report updated to show the result. | *USD · each add-on is a posted price, selected when you order · Anything outside this product and its add-ons is scoped by quote.* ### Direct-answer block: In summary - Web App Penetration Test for Compliance is $5,000 fixed. It is a manual, authenticated penetration test of one web-based application, suitable as penetration test evidence for SOC 2, ISO 27001, HIPAA, PCI DSS and CMMC. - It is performed by named individual testers holding OSCP+ and CREST certifications. The signed report lists the named tester or testers who performed the work. - Delivery is 21 days on average from start. Start is the day Agency has received payment, test credentials and the signed rules of engagement. - Add-ons, each a posted price selected when you order: API testing +$2,500, rush delivery +$3,000, additional web app +$2,500, retest +$2,000. - How to buy: Send the order request and Agency emails you the order form to sign. No sales call is needed. Order at https://getagency.com/pen-testing/order. - Not included: API testing (add-on), mobile apps, network testing, cloud configuration review, source code review, social engineering. Anything outside this product and its add-ons is scoped by quote. - The report is accepted as penetration test evidence by auditors. ## What is included - One production web-based application, on one domain or URL route. - Manual, authenticated testing, using the test accounts you provide. - Testing by named individual testers holding OSCP+ and CREST certifications. - A signed report that lists the named tester or testers who performed the work. - Delivery 21 days on average from start. - A report suitable as penetration test evidence for SOC 2, ISO 27001, HIPAA, PCI DSS and CMMC. - An attestation letter you can share in place of the full report. - Follow-up questions and discussion about the findings. ## What is not included - API testing — available as an add-on at +$2,500. - Mobile apps. - Network testing. - Cloud configuration review. - Source code review. - Social engineering. - A retest — available as an add-on at +$2,000. - A scheduled debrief call. Follow-up questions and discussion about the findings are included. ## Buy now Ordering is online and needs no sales call. Send the order request and Agency emails you the order form to sign. Add-ons are selected on the order request. Anything outside this product and its add-ons is scoped by quote. [Not sure it fits? Get a quote](https://getagency.com/lp/pen-testing-compliance#quote-form). **$5,000 fixed** — One web-based application. Delivery is 21 days on average from start. [Buy now — $5,000](https://getagency.com/pen-testing/order) Refund and reschedule terms are set out in the Terms of Service you sign with your order form. ## More about this test - [Web App Penetration Test: full details](https://getagency.com/lp/pen-testing-compliance) - [Frequently asked questions](https://getagency.com/lp/pen-testing-compliance#faq) - [Penetration test report](https://getagency.com/penetration-test-report) - [Do I need a pen test for SOC 2?](https://getagency.com/questions/do-i-need-a-pen-test-for-soc-2)