Vulnerability assessment cost in 2026: what drives the price and what cheap assessments skip
Amara OkaforApril 29, 2026
Key takeaways
Vulnerability assessment pricing ranges from roughly €1,500 for automated scan-and-report products to €40,000 or more for manual, scoped assessments of complex environments — the difference is not vendor margin, it is what the methodology covers and what it excludes.
SMBs assessed by Vulnox averaged 7.2 exploitable vulnerabilities per 100 application pages versus 3.1 for enterprise environments — smaller footprint does not mean lower density, and low-price assessments that sample rather than cover the full scope miss proportionally more in SMB environments. (Vulnox assessment data, 2024, n=47)
The three scope variables that drive cost more than any other factor: number of authenticated user roles tested, number of API endpoints in scope, and whether internal-facing applications are included alongside public-facing ones.
A fixed-price assessment with no scope definition document is a scan-and-report product regardless of how it is described. Meaningful assessments require a defined scope that specifies systems, user roles, and test methodology before pricing is possible.
Remediation support, retest after patching, and findings triage calls are almost never included in a base assessment price — these are the activities that produce actual security improvement, and their absence from a contract means the client pays for a report, not an outcome.
The hidden cost that exceeds the assessment fee in most SMB engagements: internal staff time for asset inventory, credential provisioning, network access setup, and findings triage — typically 20 to 40 hours across IT and development teams.
TL;DR
Vulnerability assessment pricing is opaque because the word assessment covers everything from a €1,500 automated scan to a €40,000 manual engagement with remediation support. The price difference reflects scope, methodology, and what happens after the report. Most organizations buying their first assessment buy a scan and receive a finding list. They then spend more time and money than the assessment cost on internal triage, remediation coordination, and the retest they did not know to budget for. This article covers what actually drives the cost and how to read a proposal to know which category you are buying.
The €3,200 assessment that produced a €90,000 incident
A 45-person SaaS company bought a vulnerability assessment before a Series A due diligence process. They wanted a clean report to show investors. The vendor quoted €3,200 for a web application assessment. The scope covered the public-facing marketing site and the main application login flow. The report came back with four findings — two low, one medium, one informational. Clean enough. Six weeks after the investment closed, an attacker accessed customer data through an API endpoint that was not in scope. The endpoint was an internal reporting API, accessible with a valid session token, that returned unfiltered records for any customer ID passed as a parameter. Classic IDOR. The scanner never touched it because it was not a public-facing endpoint and the scope document did not include authenticated internal API coverage.
The assessment was not wrong. It covered what it said it would cover. The scope document, which the client signed without reading carefully, listed the marketing site and the unauthenticated login flow. Authenticated application functionality and internal APIs were explicitly out of scope. The client had bought a report that confirmed their public pages had no critical findings. They thought they had bought confirmation that their application was secure. Those are different products. The price difference between them is roughly €12,000.
What the cost data actually shows across real engagements
7.2 vs 3.1
Average exploitable vulnerabilities per 100 application pages in SMB versus enterprise environments assessed by Vulnox. SMBs paid less for assessments that covered less and had higher vulnerability density in what was covered. The combination — smaller scope, higher density, lower price — means a lower-price SMB assessment misses more material findings per euro spent than an enterprise assessment. (Vulnox assessment data, 2024, n=47)
€1,500 to €40,000+
The realistic price range for vulnerability assessments in the European SMB and mid-market in 2026. Automated scan-and-report products start at the low end. Manual web application assessments with authenticated testing of multiple user roles run €8,000 to €20,000 for mid-complexity applications. Infrastructure and cloud environment assessments for mid-market companies run €15,000 to €40,000 depending on scope. (Vulnox market data, 2024–2026)
20 to 40 hours
Typical internal staff time consumed by an assessment engagement before the report is delivered: asset inventory compilation, credential and access provisioning for the testing team, network access configuration, scope review calls, and findings triage once the report arrives. At a fully loaded internal cost of €80 per hour, that is €1,600 to €3,200 in unbudgeted staff time on a €3,200 assessment — effectively doubling the real cost. (Vulnox client intake data, 2024)
67%
Of SMB clients in Vulnox engagements had not budgeted for a retest after remediation. The retest — a targeted reassessment confirming that identified vulnerabilities were correctly fixed and that remediation did not introduce new issues — is priced separately in almost every assessment contract. Without it, the client patches based on the report and has no confirmation the patch worked. (Vulnox assessment data, 2024)
What actually drives assessment cost: the three scope variables that matter
Assessment vendors price on scope. Scope has three variables that drive cost more than any other factor. First: authenticated user roles. Testing an application as an unauthenticated visitor is faster and cheaper than testing it as a standard user, an admin user, an API-only service account, and a privileged internal user. Each role requires separate test coverage because each role has different access and different vulnerability exposure. A one-role authenticated test and a four-role authenticated test are not the same assessment, and they are not the same price. Second: API endpoint coverage. A public-facing web application with 12 REST API endpoints and a modern SaaS platform with 200 API endpoints serving a mobile application, third-party integrations, and an internal reporting layer are different scopes by an order of magnitude. Vendors who quote a flat rate for web application testing without asking for an API endpoint count are either sampling the API surface or not testing it at all. Third: internal versus external. Public-facing applications are accessible without network access provisioning. Internal applications — admin panels, employee portals, internal APIs — require the testing team to be inside the network perimeter, either via VPN, a jump host, or an on-site testing session. That provisioning adds time. It also adds findings, consistently, because internal applications receive less security attention than public-facing ones.
Example
A SaaS company with a public application, a mobile API, an internal admin panel, and a webhook integration with a payment provider has four distinct testing surfaces. A vendor who quotes €4,500 for the web application without asking about the mobile API, the admin panel, or the payment integration scope is quoting for one surface. The other three — which in Vulnox assessment data consistently produce more critical findings per hour of testing than the public web surface — are either not included or are being sampled at a level that will not catch IDOR vulnerabilities, broken function-level authorization, or credential exposure in webhook payloads.
The relationship between scope and price is not linear. Adding the mobile API to a web application assessment adds roughly 30 to 50% to the price and typically 40 to 60% of the critical findings. Adding the internal admin panel adds 20 to 40% to the price and, in Vulnox data, produces a critical finding in 71% of cases — admin panels receive the least security attention and the most permissive authorization assumptions of any application component. The price-to-finding ratio for internal application coverage is consistently better than for public-facing coverage. Teams that exclude internal applications to reduce assessment cost are reducing the most efficient part of the engagement.
What assessment data shows about scope, price, and what gets found
Assessment base: 47 SMB and mid-market vulnerability assessment engagements, 2023–2024
Internal admin panels produced critical findings in 71% of assessments where they were in scope
Across 47 engagements, every assessment that included internal admin panel coverage found at least one medium finding. 71% found a critical finding — broken authentication, IDOR allowing access to all customer records, privilege escalation via parameter manipulation, or hardcoded credentials in the admin interface. These findings were not in assessments that excluded admin panels from scope. The exclusion was almost always made to reduce assessment cost or because the client considered internal tools lower risk than public-facing ones.
The cost reduction from excluding internal applications from scope is real. The security trade-off is that internal applications are consistently the highest-density finding surface in Vulnox assessment data. Clients who reduce cost by narrowing scope to public-facing applications are reducing coverage on the component most likely to produce a critical finding.
Fixed-price assessments without scope documents are scan-and-report products
In engagements where clients came in after a prior assessment from another vendor, Vulnox requested the prior assessment scope document. In 28 of 47 cases, no scope document existed — the prior vendor had quoted a flat fee for a web application assessment and delivered a scanner report with narrative. The clients had assumed authenticated testing, API coverage, and manual validation of findings. The report contained only automated scanner output with severity ratings. The gap between client expectation and delivered methodology was consistent and correlated directly with price: the lower the prior assessment price, the larger the gap.
Before signing any assessment contract, request the scope document and the methodology description. A scope document names the systems, user roles, and test techniques that will be applied. A methodology description explains whether testing is manual, automated, or hybrid and what tools will be used. If the vendor cannot produce these before signing, the deliverable is a scanner report regardless of how the engagement is described.
Remediation support was included in 12% of assessed prior contracts
In 47 post-assessment reviews of prior vendor contracts, 88% of contracts delivered a report and nothing else. No remediation support, no findings triage call with the development team, no retest after patching. Clients received a finding list sorted by severity and were expected to triage, prioritize, assign, remediate, and verify independently. For organizations without a dedicated security team — which describes most SMBs — the report became a backlog that nobody had the context or capacity to work through systematically.
A vulnerability assessment that produces a report the client cannot act on has produced no security improvement. The report has value as a compliance artifact. It has limited value as a security control if the client lacks the internal capacity to triage and remediate findings without expert guidance. Assessment pricing that excludes remediation support is not cheaper — it transfers the cost from the assessment line item to the internal staff time line item, where it is less visible and less efficient.
Smaller organizations cost more to assess per finding, not less
Common belief
Smaller companies have smaller attack surfaces, fewer systems, and simpler architectures. Assessing them should be faster and cheaper, and the price per finding should be lower than for a large enterprise with hundreds of systems and complex integrations.
What we found
In 47 SMB assessments, the average cost per confirmed critical or high finding was €1,840 for full-scope assessments and €4,200 for limited-scope assessments — because limited scope excluded the surfaces where findings concentrated. The cheaper assessment found fewer findings not because fewer existed, but because the surfaces with the most findings were not tested. (Vulnox assessment data, 2024)
This breaks down on the finding density side. SMBs average 7.2 exploitable vulnerabilities per 100 application pages versus 3.1 for enterprises in Vulnox assessment data. The reason is straightforward: enterprise environments have dedicated security engineering, security champions in development teams, SAST in CI/CD pipelines, and security review gates before deployment. SMBs have a developer who also handles server administration and a security budget that was approved six months ago and has not been touched since. The vulnerability density is higher. But the assessment methodology does not become cheaper proportionally — authentication testing, API coverage, and manual validation take roughly the same time per surface regardless of organization size. The result: an SMB paying for a limited-scope assessment to keep cost down is paying the lowest price for the highest-density environment.
What clients said before the engagement and what was underneath it
'We got a quote for €2,500 from another vendor for a web application assessment. Your quote is €11,000. What is the difference?'
Root cause:The €2,500 quote is almost certainly an automated scan of publicly accessible pages with a narrative report layered on top. It may include a small number of manual checks on high-traffic pages. It will not include authenticated testing as multiple user roles, API endpoint coverage, internal application testing, or manual validation of every finding. The €11,000 quote reflects the time required to do those things. The comparison is not between two prices for the same service — it is between two different services that share a name. The question to ask the lower-cost vendor: how many authenticated user roles will be tested, how many API endpoints are in scope, and will internal applications be included?
'We had an assessment last year. We fixed everything on the report. Do we really need another one this year?'
Root cause:The prior assessment covered a specific scope at a specific point in time. In the 12 months since: the application was updated multiple times, new features were deployed, a third-party integration was added, and at least one developer who was not there during the prior assessment wrote code that is now in production. The finding list from last year describes vulnerabilities in last year's application. The remediation confirmed that last year's findings were patched. Neither document says anything about this year's application. Assessment frequency should be tied to deployment frequency, not calendar year.
'We need this for a compliance audit. Can we get a report that covers the requirement without a full assessment?'
Root cause:The compliance requirement exists because regulators determined that evidence of security testing reduces breach probability. A report that satisfies the checkbox without meaningful testing satisfies the auditor and not the intent. This is a choice organizations make deliberately, and it is not inherently wrong — compliance budgets are real constraints. The risk is treating the compliance report as security assurance. If the report is for the auditor and actual security assurance comes from a separate testing program, that is a coherent approach. If the compliance report is the security program, the organization has a document and not a control.
The cost items that appear after the assessment invoice is paid
Internal staff time is the largest hidden cost and the least budgeted
Getting an assessment started requires asset inventory documentation, credential provisioning for each user role being tested, network access setup for internal application testing, and at least one scope definition call. Getting value from the report requires a findings triage session where someone with application knowledge reviews each finding, assesses exploitability in the actual environment, and assigns remediation ownership. In SMB environments without a dedicated security team, this work falls on the CTO, a senior developer, or the IT manager. At 20 to 40 hours across the engagement, at internal cost rates of €80 to €120 per hour, the hidden cost is €1,600 to €4,800 — on top of the assessment invoice.
Retest pricing is almost never in the base contract
After remediation, confirming that findings were correctly patched requires a targeted retest. This is not a full assessment — it is a focused test of the specific findings from the original report, plus a check that remediation did not introduce adjacent issues. Retest pricing typically runs 25 to 40% of the original assessment fee. It is almost never included in the base contract. 67% of SMB clients in Vulnox engagements had not budgeted for it. The consequence: organizations patch based on the report, assume the patch worked, and have no confirmation until the next full assessment — or until an attacker finds that the patch was incomplete.
Scope changes after work begins are priced as change orders
Assessment vendors scope based on what the client describes. When testing begins and the actual environment differs from the description — more API endpoints than disclosed, an additional application environment, a cloud integration not mentioned in scoping — the vendor either excludes the undisclosed surface or issues a change order. Change orders on security assessments run €500 to €2,000 per day of additional testing required. Organizations that provide incomplete environment descriptions during scoping, intentionally or because they do not have accurate asset inventories, consistently experience assessment cost overruns.
How to buy an assessment that produces security improvement, not just a report
Step 1. Organizations request quotes before documenting scope, receive quotes that are not comparable, and select on price without understanding what each price includes. The scope document takes two to four hours to produce. Its absence costs significantly more in scope mismatches, change orders, and assessment coverage gaps.
- 1Security lead or CTO
Before requesting quotes, document the actual assessment scope: every application in scope by URL and environment, every user role that will be tested with example credentials, every API integration including internal-only endpoints, and every cloud environment or infrastructure component to be included. This document becomes the scope definition that vendors price against. Without it, vendors quote against their assumptions, which are almost always narrower than the client's actual environment.
Expected outcomeQuotes that are comparable to each other because they are priced against the same scope. Elimination of post-engagement change orders for undisclosed systems. A scope document that becomes the acceptance criteria for the delivered assessment.
- 2Security lead or procurement
Request a methodology description from every vendor quoting the engagement. The methodology should specify: which testing is manual versus automated, how many hours are allocated to manual testing, which authenticated user roles will be tested and how many, whether API endpoints will be individually tested or sampled, and what the process is for validating findings before they appear in the report. Compare methodology documents, not just prices.
Expected outcomeDifferentiation between scan-and-report products and manual assessment engagements before signing. Basis for holding the vendor accountable to the methodology if the delivered report does not match the described approach.
- 3Internal IT or development team
Before the assessment starts, prepare the provisioning package: test credentials for each user role, VPN or jump host access for internal application coverage, a list of API endpoints with example requests, and a point of contact for each application in scope. Doing this before kickoff, not during the active testing window, prevents scope compression — testers who cannot access a system in the first two days of a time-boxed engagement often exclude it rather than extend the timeline.
Expected outcomeFull scope coverage within the contracted timeline. Reduction of internal staff time during the active assessment. Prevention of scope exclusions caused by access provisioning delays.
- 4Security lead with development team
Budget for a findings triage session as part of the assessment contract — either as an included deliverable or as a separately priced add-on. In the triage session, the assessment team reviews each finding with the application team, confirms exploitability in the actual environment, answers developer questions about remediation approach, and identifies which findings chain with each other. This session is where the report becomes an action plan. Without it, developers receive a finding list sorted by CVSS score with no context for what each finding means in their specific environment.
Expected outcomeRemediation assignments that development teams understand and accept. Elimination of the back-and-forth between security and development about whether findings are real. Faster mean time to remediation for confirmed findings.
- 5Security lead
Contract for a retest at the time of the original assessment, not after remediation is complete. Retest pricing negotiated before signing is 15 to 25% cheaper than retest pricing requested after the fact, because the vendor can schedule it into their pipeline. The retest should cover every finding rated medium or above, plus a spot check of low findings in high-risk application areas. It should be conducted within four weeks of the remediation deadline.
Expected outcomeConfirmed remediation of identified findings before the next scan cycle. Identification of incomplete patches and remediation-introduced issues. A documented retest report that serves as evidence of remediation for compliance purposes.
How assessment pricing and scope requirements are changing in the next 18 months
Compliance frameworks will begin specifying minimum assessment methodology requirements — not just that an assessment was conducted, but that it included authenticated testing and API coverage — within 18 months, driven by breach patterns from scan-only programs.
The current framework language accepts a vulnerability assessment without specifying methodology. Auditors checking the box that an assessment exists cannot distinguish a €2,500 scan-and-report from a €15,000 manual assessment. Regulators updating frameworks are aware of this gap. PCI DSS 4.0 has already moved toward specifying penetration test methodology requirements. The same pressure will reach vulnerability assessment requirements in NIS2 implementing acts and ISO 27001 supplementary guidance. The signal is already in the regulatory consultation documents.
Confidence: highIf by October 2027 neither NIS2 implementing acts nor ISO 27001:2022 supplementary guidance has added methodology specifications to vulnerability assessment requirements, the prediction is wrong. Track the ENISA NIS2 guidance publications and ISO/IEC JTC 1/SC 27 revision announcements.Automated assessment platforms with AI-assisted finding validation will compress the price floor for basic web application assessment to under €800 within 24 months, widening the gap between automated and manual assessment deliverables and forcing manual assessment vendors to differentiate on scope and remediation support.
The current price floor for automated scan-and-report products is €1,500 to €3,000, which reflects licensing and analyst time for report narrative. AI-assisted finding validation eliminates most of the analyst time for basic finding classification. Several platforms are in early access for this capability. When it reaches general availability, the scan-and-report product category will be priced as a commodity. Manual assessment vendors that currently compete on price with scan products will face margin compression. Vendors that have built differentiation on scope coverage, remediation support, and retest inclusion will be less affected.
Confidence: mediumIf by April 2027 no major vulnerability assessment platform has released an AI-assisted finding validation feature in general availability that reduces base assessment pricing below €1,000 for standard web applications, the timeline prediction is wrong.
Further Reading
Vulnerability Assessment
comprehensive vulnerability assessmentGap Analysis
framework gap analysisNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkOWASP Web Security Testing Guide
OWASP web security testing
Frequently Asked Questions
How much does a vulnerability assessment cost in 2026?
Realistically, €1,500 to €40,000 depending on scope and methodology. Automated scan-and-report products start at €1,500 to €3,000. Manual web application assessments with authenticated multi-role testing run €8,000 to €20,000 for mid-complexity applications. Infrastructure and cloud assessments for mid-market companies run €15,000 to €40,000. The price difference reflects what the methodology covers — not vendor margin. (Vulnox market data, 2024–2026)
What is included in a vulnerability assessment versus what costs extra?
Base assessment contracts typically include: automated scanning, manual testing of the agreed scope, and a findings report sorted by severity. Almost always excluded from base price: authenticated testing of multiple user roles (often an add-on), internal application coverage, API endpoint testing beyond public-facing surfaces, a findings triage call with the development team, remediation support, and a retest after patching. These exclusions are where most post-signing cost surprises occur. Request a line-item scope document before signing.
Why are SMB vulnerability assessments sometimes more expensive per finding than enterprise assessments?
SMBs averaged 7.2 exploitable vulnerabilities per 100 application pages versus 3.1 for enterprises in Vulnox assessment data — higher density, because enterprise environments have more security engineering built in. But the assessment methodology does not become cheaper proportionally with organization size. Testing authenticated user roles, API endpoints, and internal applications takes similar time regardless of organization size. SMBs that reduce cost by narrowing scope to public-facing applications are paying the lowest price for the highest-density environment and covering the lowest-density surface. (Vulnox assessment data, 2024, n=47)
What scope variables drive vulnerability assessment cost the most?
Three variables drive cost more than any other: number of authenticated user roles tested (each role requires separate coverage and distinct test cases), number of API endpoints in scope (a 12-endpoint application and a 200-endpoint SaaS platform are not the same scope), and whether internal applications are included alongside public-facing ones (internal admin panels, internal APIs, and employee portals require network access provisioning and consistently produce the highest finding density in Vulnox assessment data).
How do I tell if a vulnerability assessment quote is for a scan or a real assessment?
Request a methodology description before signing. It should specify: which testing is manual versus automated, how many hours are allocated to manual testing, which authenticated user roles will be tested, whether API endpoints are individually tested or sampled, and how findings are validated before appearing in the report. If the vendor cannot produce this document, the deliverable is a scanner report with narrative. A fixed price with no scope definition document is always a scan-and-report product, regardless of how the engagement is described.
What are the hidden costs of a vulnerability assessment?
The most consistently underbudgeted costs: internal staff time for asset inventory, credential provisioning, and findings triage (20 to 40 hours, €1,600 to €4,800 at internal rates); the retest after remediation, priced separately at 25 to 40% of the base assessment fee in almost every contract; and change orders for undisclosed systems discovered during testing. In SMB engagements, internal staff time frequently exceeds the assessment invoice. (Vulnox client intake data, 2024)
How often should a vulnerability assessment be conducted?
Frequency should track deployment frequency, not the calendar. If the application is deployed weekly, a point-in-time annual assessment is outdated before the ink dries on the report. Practical approach: a full-scope assessment annually or after significant architectural changes, targeted assessments of new features or integrations at release, and automated scanning continuously between manual assessments. The prior assessment covers the prior application. Every material deployment since then is untested territory.
Related Articles
API security assessment: what automated tools miss and manual testing finds
Automated API security tools find the vulnerabilities they were designed to look for. The findings that matter in real assessments, broken object-level authorization, JWT algorithm confusion, and unauthenticated internal endpoints, require a tester who understands what the API is supposed to do before probing what it actually does.
CVSS score explained: what the metric captures, what it misses, and how to fix your prioritization
In 40% of Vulnox assessments, vulnerabilities scored CVSS 9.0 or higher were on systems with compensating controls that materially reduced the actual risk. The score was accurate. The priority order it implied was not. This guide covers how to use CVSS correctly and what to layer on top of it.
Post-breach vulnerability assessment: what the attacker left behind
Most post-breach assessments start too late and end too early. They confirm what was hit, not what the attacker mapped before they moved. The second breach usually comes from the reconnaissance that happened in the first.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.