Want a price for your penetration test?
Thirty minutes with Peter, no sales pitch. You will get a clear scope, a fixed price and a date we can start.
Most Australian penetration testing providers will not publish a price. We will. A Siege Cyber penetration test is quoted as a fixed price before the engagement starts, and the ranges below are the real ones we work to.
A single test typically lands between $3,400 and $16,500 excluding GST, depending on what is being tested and how large it is. The sections below explain what sits at each end of that range and what moves a quote up or down, so you can work out roughly where you will fall before you speak to anyone.
| Test type | Price range (ex GST) | Typical reason for testing |
|---|---|---|
| Basic website | $3,400 to $6,500 | Brochure or marketing site, WordPress, reputational risk |
| External network | $3,400 to $9,500 | Internet-facing exposure, cloud and Microsoft 365, remote access |
| Web application and API | $5,900 to $16,500 | SaaS platforms, customer portals, anything behind a login |
| Internal network | $5,900 to $16,500 | Active Directory, privilege escalation, insider threat simulation |
| Mobile application | $5,900 to $16,500 | iOS and Android apps, data storage, API endpoints |
| Custom and red team | Scoped individually | Wireless, hardware, red teaming, multi-element programmes |
All prices exclude GST. Every engagement is quoted at a fixed price, so the number on the proposal is the number you pay.
Prices on this page are current as of 18 October 2026, quoted in Australian dollars and excluding GST. Every price includes manual testing, the report, a debrief call and the retest.
Penetration testing is priced on tester days, and tester days are driven by how much there is to test and how deep we have to go. Five things account for almost all the variation.
| What drives the price | Keeps it lower | Pushes it higher |
|---|---|---|
| Size of the scope | Ten external IP addresses, or one application with a handful of user journeys | Two hundred addresses, or a platform with sixty journeys |
| Authentication and user roles | Tested as an anonymous visitor only | Tested as an admin, a standard user and a customer, then checked to see whether one can reach another’s data |
| Complexity of the application | A content site that behaves predictably | A multi-tenant platform with its own API, background jobs and third party integrations |
| Retesting | Included in our price, so there is no second invoice | Charged as a separate engagement by some providers, which is worth checking before you compare quotes |
| One-off or programme | Several tests scheduled across twelve months, which lowers the cost per test | Single tests booked one at a time |
Whichever test you choose, every engagement includes the following.
| What you get | What that means in practice |
|---|---|
| A fixed price before you commit | A scoping conversation and a fixed-price proposal, agreed before anything starts |
| CREST accredited testers | The accreditation is assessed and held at company level, not borrowed from an individual |
| Manual testing | Testers working through your systems by hand, not a scanner report with a logo on it |
| Findings ranked by business impact | Ranked by what they would let an attacker do to your business, not by a raw scanner severity score |
| A report two audiences can use | An executive summary your board can read and a technical section your engineers can act on |
| Specific remediation advice | Clear, specific fixes rather than generic references to a standard |
| A free retest | Run once you have fixed the findings, so you end up with a clean report rather than a list of problems |
| A debrief call | We walk your team through the results |
Many Australian businesses need more than one test a year, either because a customer contract requires it, because they release software continuously, or because a compliance framework expects regular testing. Rather than quoting each test separately, we can build a twelve month testing programme sized to your environment and your budget, with the work scheduled across the year and the cost spread evenly.
This usually works out cheaper per test than booking them one at a time, and it means the testing calendar is already agreed when a customer asks for evidence.
| Step | What happens |
|---|---|
| 1. A short conversation | Thirty minutes is usually enough to understand what you have and why you are testing it |
| 2. A scoping document | We write down exactly what is in scope, what is out, and what assumptions the price depends on |
| 3. A fixed-price proposal | One number, inclusive of reporting and the retest |
| 4. Scheduling | We agree dates that suit your change calendar rather than ours |
If the scope turns out to be materially different from what was described, we tell you before we start, not after the invoice.
Two quotes for the same system can look very different and both be honest, because they are not quoting the same work. Three questions separate them.
| Ask every provider | Why it matters | Our answer |
|---|---|---|
| How many tester days are in this price? | Tester days are the main cost driver, so a noticeably lower price almost always means fewer days | Stated in the proposal before you sign anything |
| Is the testing manual or automated? | A scan finds known issues in known software. A test finds the chain of small problems a scanner cannot connect | Manual, by CREST accredited testers |
| Is a retest included? | Without one you are left with a list of problems rather than a clean report you can show a customer | Included, at no extra cost |
For most small and medium Australian businesses, between $3,400 and $16,500 excluding GST for a single test. A basic website test sits at the lower end. A large web application or an internal network test with Active Directory in scope sits at the upper end.
Usually because they are not quoting the same work. The three most common differences are the number of tester days, whether the testing is manual or largely automated, and whether a retest is included. Ask all three questions when you compare.
A very low quote generally means a short engagement, an automated scan, or both. That has a place, and a vulnerability scan is a reasonable thing to buy, but it should be bought knowingly. A scan finds known issues in known software. A penetration test finds the chain of small problems that a scanner cannot connect.
Most engagements run between three and ten working days of testing, with the report following shortly after. Scheduling is normally the longer lead time, so it is worth booking ahead of a customer deadline.
Annually at minimum, and after any significant change to the systems in scope. If you ship software regularly, or if you hold a certification that expects it, more often.
No. A retest after you have remediated is included in the price.
Between $5,900 and $16,500 excluding GST for most Australian SaaS platforms and customer portals. What moves you through that range is the number of user roles that need testing and the number of distinct user journeys in the application. A single-role application with a handful of journeys sits near the bottom. A multi-tenant platform with its own API, background jobs and sixty journeys sits near the top. Reporting, the debrief call and the retest are included at every price point.
Between $3,400 and $9,500 excluding GST. The main driver is the number of live hosts in scope. Ten external IP addresses sits near the bottom of that range and two hundred addresses sits near the top. Cloud and Microsoft 365 exposure and remote access are the usual reasons for testing.
$3,400 excluding GST, for a basic website test on a brochure or WordPress site. That still means manual testing by CREST accredited testers, a report with an executive summary and a technical section, and a free retest once you have fixed the findings. We do not sell a cheaper automated scan dressed up as a penetration test.
Tell us what you need tested and we will come back with a fixed price and a scope you can hold us to. If a penetration test is not the right thing to buy yet, we will say so.
Next step: Book 30 minutes with Peter for a no-obligation scoping conversation, or send us the details and we will quote it.