The price of a penetration test is set by the number of days the tester works, not by the type or the brand. The British NCSC writes that the scope of a test is usually given in person-days. One public document shows it: CESNET offered the University of West Bohemia 30 person-days of in-depth tests at a base price of CZK 720,000, that is CZK 24,000 a day, and after a member discount CZK 480,000 excluding VAT. Czech Radio estimated the value of a contract for testing its internet services at CZK 500,000 excluding VAT over 24 months. Those are the figures of large institutions. We found no general price list that could be verified, so you will not find one here.
- The price is set by the tester's number of person-days, not by the type or the brand (NCSC).
- A public CESNET offer: 30 person-days at a base price of CZK 720,000, that is CZK 24,000 a day.
- A general price list cannot be relied on, so compare days, tester names and the retest, not the total amount.
- An offer for a few hours of work is a scan rather than a penetration test.
What you pay for: days, not outcome
NCSC wants the preparation to produce a document with the boundaries of the test, the types of test and an estimate of time and work, usually in person-days. The PCI SSC guide adds that a test can last days or weeks depending on the scope and the size of the environment, and can grow when the tester comes across further systems. According to NCSC, changing the scope mid-test is likely to change the timeframe and the price, or the omitted part is recorded as a limit of the test.
On its page Lumenax states that a smaller website usually takes 3 to 5 days of testing, larger systems longer, and that after a short agreement on scope you get the price as a fixed amount in advance. There is no price list there and we do not have one either.
What public offers and calls show
| Source | What is bought | Price |
|---|---|---|
| CESNET for the University of West Bohemia, offer 2022/23 | In-depth penetration tests, 30 person-days | Base CZK 720,000, after a one-third member discount CZK 480,000 excluding VAT (CZK 580,800 with VAT) |
| CESNET for Palacký University, offer valid until 31 December 2025 | In-depth penetration tests, scope not stated in the offer | Base CZK 360,000, after a one-third discount CZK 240,000 excluding VAT (CZK 290,400 with VAT) |
| Czech Radio, call ref. MR48_2024 | Test of internet services and digital products, framework agreement for 24 months | Estimated value CZK 500,000 excluding VAT |
Read them with care. The CESNET offers are aimed at public institutions and include a discount for CESNET members, and only the first states the scope in days. The Czech Radio figure is the buyer's estimate, not a price paid. A market price cannot be read from a few documents. They do show an order of magnitude: for these institutions, hundreds of thousands of crowns. Converting to your case is simple: the number of days from the brief times the rate from the offer, plus the 21% VAT that the CESNET offers add.
What the number of days is made of
- Scope. How many websites, APIs, addresses and servers are tested. Lumenax names the number of applications and the depth of the test as factors.
- From where and with what. From outside, from inside, or both (article on the web and the internal network). According to PCI SSC a black box can take more time, money and work than a grey or white box (article on test types).
- Special systems. NCSC advises naming unusual systems already in the enquiry, so the supplier knows what people it needs.
- Where it is tested. According to PCI SSC, a test on production during working hours is prolonged by the effort to avoid breaking anything. A separate environment identical to production speeds the test up.
- A covert test. NIST calls it time-consuming and expensive because the tester has to stay hidden. An overt one is cheaper.
- The retest. Whether it is in the price and how many times. Lumenax states that the retest of fixes is included in its price. With another supplier, find out in the contract (article on the retest).
When an offer is suspiciously cheap
The PCI SSC guide compares two things. A vulnerability scan typically runs seconds to minutes per computer and is done by automated tools. A penetration test is manual work that may use a scanner, lasts days or weeks and ends with a description of every verified weakness, including how and how far it can be exploited. NIST notes that manual searching finds new or obscure weaknesses that a scanner misses, but is much slower.
An offer for a few hours of work therefore describes a scan rather than a test. A scan makes sense and Decree No. 409/2025 Coll. requires it at least once a year in the higher-obligations regime, but it is not a penetration test. So ask how many days and whose.
How to compare two offers
- Days. How many person-days the offer counts and for exactly what. Give the same brief to two or three suppliers.
- People. Who will do the test. Decree No. 409/2025 Coll. requires, in the higher-obligations regime, a record of the names of the individuals who did the test, so you can ask for names in advance. In its call, Czech Radio required 3 testers with at least 5 years of practice and 3 similar contracts of at least CZK 200,000 each. PCI SSC writes that certificates are not mandatory and are not enough on their own: ask about years of practice, the number of similar contracts and work with your technologies.
- Output. A report with verified findings, risks and a way to fix them (NCSC). Not a machine-generated list.
- Retest and changes. Whether it is in the price, and what happens if the scope changes mid-test.
- An exceptionally low price. In its call, Czech Radio asked for a written justification for such an offer. You can ask the same.
What a firm of twenty people does
You have a web shop and an internal network. Write down exactly what you want tested and split it into two parts: what is visible from the internet, and what lies inside (see the article on preparation). Ask two or three firms for prices and get from each the number of person-days and the names of the testers. Compare days, not the total amount. Then plan for repetition: Decree 409/2025 Coll. requires a test in the higher-obligations regime at least once every 2 years, PCI DSS for payment cards at least once every 12 months. So it will not be a one-off expense. What happens after the start is described in the article on how the test runs.
Mistakes that keep repeating
- Only the total amount is compared. Two equal amounts can mean 5 and 10 days.
- The brief is vague. According to NCSC, changing the scope mid-test changes time and price.
- The retest is not settled before signing. Then it is argued who pays for it.
- Price is taken as proof of quality. NCSC writes that the quality of a test is closely tied to the abilities of the testers, not to what it cost.
Common questions
Can the price be reduced?
By narrowing the scope. The price follows the days of work and NCSC writes that a change of scope changes time and price. You can start with the system where the risk is greatest. A shorter test also shows only the part you put into the scope.
Is the price stated with VAT?
Check it in the offer. The public CESNET offers state the price excluding VAT and VAT of 21% separately.
Will an insurer or a subsidy cover a penetration test?
The sources we opened do not address this, so we do not claim it. Ask the insurer or the subsidy provider directly what they accept.
Is a penetration test a one-off cost?
No. Decree 409/2025 Coll. requires a test in the higher-obligations regime at least once every 2 years. PCI DSS requires a test at least every 12 months and after a significant change. NIST writes that, given the cost, an annual test may be enough.
Is the retest included in the price of the test?
At Lumenax it is, as its page on penetration tests states. With another supplier, find out in the contract. PCI SSC adds that when a fix takes a long time, a new test may be needed.
Sources
- CESNET, Preliminary offer of penetration tests for the University of West Bohemia in Plzeň 2022/23, until 31 December 2023: https://smlouvy.gov.cz/smlouva/soubor/24459747/PRILOHA_9815_0009_22.doc
- CESNET, Offer of penetration tests for Palacký University Olomouc, until 31 December 2025: https://smlouvy.gov.cz/smlouva/soubor/41391477/UPOL_-_penetracni_testy_2025_%281%29_Redig.pdf
- Czech Radio, Call for tenders ref. MR48_2024, Penetration testing of internet services and digital products: https://profily.proebiz.com/tender/4893/attachments/download/37072
- NCSC, Penetration testing, published 8 August 2017, reviewed 10 January 2022: https://www.ncsc.gov.uk/guidance/penetration-testing
- PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017, sections 2.1, 2.3.4, 3 and 4.3.2: https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf
- NIST Special Publication 800-115, September 2008, sections 2.4.2, 5.2.1 and 5.2.2: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
- Decree No. 409/2025 Coll., § 24(5), effective from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-409
- PCI DSS v4.0, SAQ D for Merchants, April 2022, requirements 11.4.2 and 11.4.3: https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf
- Lumenax, Penetration tests, viewed 25 October 2026: https://www.lumenax.cz/penetracni-testy
How to prepare for a penetration test: rules, consents and material
Retest after a penetration test: when it is mandatory and what it checks
Black box, grey box, white box: how to choose the type of penetration test
