Most Canadian small and mid-sized businesses should budget roughly $5,000 to $25,000 CAD for a single penetration test. The final number depends on scope, not on how many employees you have. Published Canadian ranges run from about $1,500 for a narrow external test to $150,000 or more for multi-week red-team work or a year-round testing subscription.
This guide breaks the price down by type of test, explains what moves a quote up or down, shows what should be included, and gives you a way to compare proposals fairly. Figures come from Canadian price lists and guides published in 2025 and 2026. Treat them as planning ranges and confirm them with a written, scoped quote.
Across the Canadian price guides we reviewed, the broad band is $5,000 to $75,000 or more, with the middle of the market clustered between $5,000 and $30,000. The lower and upper ends are real, but they describe very different jobs.
| Engagement | Typical Canadian range (CAD) |
|---|---|
| Focused external test, small SaaS app or small network | $1,500 to $8,000 |
| External network test | $5,000 to $15,000 (some guides run to $35,000 for larger estates) |
| Internal network test | $7,000 to $20,000 |
| Web application and API test | $4,000 to $25,000 |
| Cloud security assessment | $6,000 to $30,000 |
| Active Directory assessment | $10,000 to $25,000 |
| Compliance-driven test (SOC 2, PCI DSS, PIPEDA, Law 25) | $7,000 to $30,000 |
| Red team operation | $15,000 to $75,000, and up to $150,000 for multi-week objective-based work |
| Annual continuous testing subscription | $40,000 to $120,000 or more |
These ranges overlap because providers scope differently. One firm’s “external test” covers 16 internet-facing systems, another’s covers a single domain. That is why a range from a guide is a starting point for your budget, not a price you should expect to be quoted.
For most small businesses, the realistic entry point is an external network test or one web application assessment, usually in the $5,000 to $15,000 range. A company with a customer portal, several user roles and a cloud back end will land higher. A 12-person engineering firm with a custom client portal can be a harder, pricier test than a 90-person office that runs only Microsoft 365.
Penetration testing is sold by tester effort. Canadian providers commonly estimate consultant day rates somewhere between $1,400 and $2,800, and a fixed-fee quote is essentially a day count multiplied by a rate, with margin on top. Anything that adds testing days adds cost.
How much the tester knows up front also changes the price. Black-box testing, where the tester starts with nothing, often costs more than grey-box testing with credentials supplied, because time goes into discovery. Grey-box is frequently the better value for a business that wants depth on a specific application.
Rush scheduling, on-site work and social engineering components (such as phishing or physical access tests) can all raise a quote. Remote delivery avoids travel cost, and most testing for Canadian businesses can be done remotely.
A complete proposal covers more than the hours of testing. Before you accept a quote, confirm these items are written down:
Extras that commonly cost more: an executive presentation with attack-path diagrams (often 15% to 25% on top), additional rounds of retesting, an attestation letter formatted for a specific auditor, and out-of-hours testing windows.
These are illustrative planning scenarios built from the ranges above, not quotes.
A 25-person professional services firm. The firm runs Microsoft 365, a VPN and a handful of public-facing services. An external network test with one retest is the sensible first step. Budget roughly $5,000 to $15,000.
A software company with a customer portal. One web application with admin, manager and user roles, plus an API, usually falls between $8,000 and $25,000. If a customer’s security questionnaire asks for a report, grey-box testing with credentials gives the deepest findings per dollar.
A manufacturer with plant-floor and office networks. Internal network testing, Active Directory review and an external test together tend to fit within $15,000 to $40,000, depending on the number of sites and segments.
A company preparing for SOC 2 or PCI DSS. Expect a compliance-scoped test to carry the 15% to 25% premium for documentation. PCI DSS asks for internal and external penetration testing at least annually and after significant changes, so plan it as a recurring line item rather than a one-off.
If a quote is far below every range above, ask what is actually being delivered. Sub-$1,000 offers are almost always an automated vulnerability scan. A scan is useful for finding known issues and keeping patching honest, and it costs far less. But it does not involve a person attempting to exploit weaknesses and chain them together, and it generally does not satisfy a customer or insurer asking for a penetration test report.
The reverse also applies. A six-figure price for a small environment deserves a line-by-line explanation of the days and rates behind it.
Two quotes that look similar can describe different products. Normalise them before you compare prices:
A quote that fits your scope, includes a retest and spells out exclusions is usually a better buy than the cheapest line on the page.
A one-time test suits a business that changes its environment infrequently: you test, fix, retest and file the report. A continuous or subscription model, often priced at $40,000 to $120,000 or more per year, suits organisations that ship code constantly and need coverage of new releases, a live findings portal and repeated retesting. For most small and mid-sized businesses, an annual test plus a retest after significant changes is the practical rhythm, supported by regular vulnerability scanning in between.
A penetration test is one of the few security purchases that produces evidence you can show others. Customers, auditors and cyber insurers increasingly ask for it. Regulators set the expectation too: OSFI’s technology and cyber risk guideline expects federally regulated financial institutions to test their controls, and Quebec’s Law 25 raised safeguard expectations for personal information held in Quebec. If you are weighing the spend against the risk, this overview of website security and customer trust lays out why brand reputation is tied to how well you protect visitors and customers.
Cost of a breach is the other side of the ledger. IBM’s research, as cited in a 2026 Canadian industry guide, puts the average Canadian breach at about CA$7.11 million. Even a small business facing a fraction of that figure will find a $10,000 test inexpensive by comparison.
If you are mapping which threats a test should target first, our guide to the biggest cybersecurity threats facing Canadian businesses is a good place to start. If privacy law is driving the project, the PIPEDA compliance checklist shows what regulators expect you to have in place.
The most common waste in penetration testing is a report that is paid for, filed and never remediated. Plan the following alongside the test fee:
A useful rule of thumb is to hold back some budget, set by your own risk and environment, so the remediation work does not wait for next year’s cycle.
We see the same pattern with small and mid-sized businesses in Ontario and across Canada. Owners ask “what does a pen test cost?” when the better question is “what are we trying to prove, and to whom?” A customer questionnaire, a cyber insurance renewal and a SOC 2 audit each need slightly different evidence, and scoping the test to that evidence is what keeps the price sensible.
Our view is that a test is most valuable when it sits inside a running security programme: monitoring, endpoint protection, patching, backups and a plan for what happens when something is found. That is why we offer penetration testing alongside 24/7 security operations, managed anti-virus with EDR and compliance support, so the findings turn into fixes instead of a PDF in a folder.
We also believe in plain-language reporting. You should leave the debrief knowing which three things to fix first and why.
Geeshan
NetFusion Designs is a SOC 2 Type II certified managed IT and security provider serving businesses across Ontario and Canada. We offer penetration testing, managed anti-virus with EDR and a 24/7 SOC with managed detection and response, so testing can sit inside a wider security programme. We do not publish a fixed price for penetration testing because the right quote depends on your scope.
To scope a test, start with our penetration and vulnerability assessment page, or see our cybersecurity services for how testing connects to monitoring and response. If you want to understand which kind of test fits, our comparison of a pen test and a red team exercise explains the difference. Businesses preparing for audits can also look at our IT compliance support in Ontario.
Most small businesses should plan on $5,000 to $15,000 CAD for an external network test or a single web application assessment. Very narrow tests can cost less, and businesses with several applications, roles or cloud environments will pay more. The scope of the work, not headcount, sets the price.
No. A vulnerability scan is automated and finds known weaknesses, so it costs far less. A penetration test is human-led: a tester tries to exploit weaknesses and chain them together to show real impact. Customers and auditors asking for a penetration test report generally expect the second.
At least once a year, and after significant changes such as a new application, a major infrastructure change or a cloud migration. PCI DSS requires internal and external penetration testing at least every 12 months and after significant change. Many cyber insurers and enterprise customers expect the same rhythm.
It depends on the provider. Many include one retest within 30 to 90 days, while others bill it separately, commonly between $1,500 and $6,000. Ask for the retest terms in writing before you sign.
SOC 2, PCI DSS, ISO 27001, HIPAA and PIPEDA-related work requires additional documentation and attestation. Canadian providers commonly add 15% to 25% over a standard test of the same scope for that effort.
%20(1).avif){kind=logo}
%201.avif)
