How much does a pentest cost in Spain? 2026 pricing guide

By Kike Gandia · Co-Founder & CEO, OSCP

A pentest in Spain costs between €2,000 and €15,000 for a standard scope, depending on the type of system: web and e-commerce from €2,500 to €8,000, APIs from €2,000 to €6,000, mobile apps from €3,000 to €7,000, internal or perimeter networks from €4,000 to €12,000, Active Directory from €4,000 to €10,000, cloud from €5,000 to €15,000, and CMSs such as WordPress or Magento from €2,000 to €6,000. A red team exercise starts at €12,000. This guide breaks down what drives each figure, what a quote should always include and how to spot proposals that add no value.

Why does the price of a pentest vary so much?

A pentest isn't an off-the-shelf product. It's a highly technical, tailored service that depends on multiple factors: the number of assets to analyze (applications, endpoints, servers, IP ranges), the type of environment (web, internal network, cloud, mobile), the depth of the analysis (black, gray or white box), the estimated execution time and the experience level of the team running it.

A web pentest for an application with 10 endpoints is priced very differently from a full audit of a 500-employee company's network infrastructure. Asking for a price without a defined scope is like asking the price of a building project without blueprints.

Price ranges by pentest type in Spain (2026)

These are indicative ranges in the Spanish market for medium-sized projects:

Web pentest (application or e-commerce): €2,500 – €8,000
API pentest (REST/GraphQL): €2,000 – €6,000
Mobile app pentest (iOS or Android): €3,000 – €7,000
Internal / perimeter network pentest: €4,000 – €12,000
Active Directory pentest: €4,000 – €10,000
Cloud pentest (AWS, Azure, GCP): €5,000 – €15,000
CMS pentest (WordPress, Magento, Drupal): €2,000 – €6,000
IoT pentest: €3,500 – €10,000
Phishing simulation (campaigns + report): €1,500 – €4,000

These ranges assume a standard scope for a mid-sized company. Projects with a larger attack surface or high confidentiality requirements can exceed these figures. Cost also varies depending on whether a retest after fixes is requested (usually included or at a reduced rate).

What should a pentest quote always include?

Regardless of the provider, a serious quote should include:

Detailed scope: exactly which systems are tested, with clear boundaries.
Methodology: reference to standards like OWASP, PTES, OSSTMM or MITRE ATT&CK.
Box type: black (no prior info), gray (with user credentials) or white (full access to code and architecture).
Technical report: description of vulnerabilities found, evidence, CVSS, reproduction steps.
Executive report: a non-technical summary for management.
Closing meeting: presentation of findings and remediation roadmap.
Post-delivery support: a period in which you can ask questions about remediation.

A quote that only mentions "security testing" without specifying scope or methodology is a red flag.

Red flags in a pentest offer

The market is noisy. These are the signs that should make you wary of a proposal:

⚠ Price below €500: a "pentest" at that price is really an automated scan. Automated tools don't find broken business logic, complex access control issues or vulnerabilities in authentication flows.

⚠ No defined scope: a serious provider will never quote without understanding what needs to be tested.

⚠ No team certifications: OSCP, CRTO, BSCP, eWPTX and other offensive certifications signal that the pentesters have real experience. If they don't mention them, ask directly.

⚠ No sample report: asking to see an anonymized report from a previous project is reasonable. If the answer is a flat no, be wary.

⚠ No retest or support: a pentest with no follow-up to verify the fixes has very limited value.

Pentest vs vulnerability assessment: the price difference

A vulnerability assessment (VA) is cheaper because it's mostly automated: scanners are run, the results processed and a report of known vulnerabilities delivered. The cost usually ranges between €800 and €3,000.

A pentest goes further: the analyst actively exploits the vulnerabilities, chains findings to escalate privileges, simulates a real attacker's techniques and documents the real impact, not just the potential one. That's why it's more expensive and why it adds far more value as evidence of real security.

The rule of thumb: if you need to prove to your client, an auditor or your board that a system is secure, you need a pentest. If you want a quick view of exposure to prioritize patches, a VA can be the first step.

FAQ

Is the cheapest pentest always a bad choice?

Not necessarily, but you should understand what you're buying. A cheaper project can be perfectly valid if the scope is limited and well defined. The problem is when a low price hides superficial work sold as a complete pentest. Always compare scope, methodology and team credentials, not just the number.

How much does a web pentest cost in Spain?

For a standard-sized web application (10-30 endpoints, user authentication and an admin panel), the usual range in Spain is between €2,500 and €6,000. If the application is complex (extensive business logic, multiple roles, third-party integrations), the cost can exceed €8,000.

How often should I run a pentest?

At a minimum, once a year. You should also run a pentest whenever you make significant changes to your application, when you need to comply with NIS2, DORA or ISO 27001, or before launching a new product.

Can I pay for the pentest in stages?

Yes. Many providers offer payment in two parts: a percentage on signing the contract and the rest on delivery of the report. On large projects, it's also possible to agree separate phases (e.g., web phase first, network phase later), which spreads the cost across the fiscal year.

Cybersecurity in short form

Don't order a pentest until you've watched this

Sources

INCIBE — security guides for businesses (in Spanish)

Request a no-obligation quote