What does a penetration test cost?
At LOKI a human-reviewed pentest of one web application or API costs from €500 per month excluding VAT: one bounded test per agreed month, with evidence, the fix and one retest included. Larger or more complex scopes get a fixed written quote within one business day.
A quote never starts a test. Testing begins only after a signed agreement that names the target, exclusions and test window.
Published prices
Fixed starting prices, no hourly billing.
| Service | Price | What is included |
|---|---|---|
| SKYEN: web application or API pentest | from €500 / month excl. VAT | One bounded test per agreed month, human-reviewed findings, evidence, impact, fix guidance, one retest |
| Android app test (pilot) | from €300 / month excl. VAT | One written-authorised test cycle per agreed month with bounded safe checks and human-reviewed evidence |
| Shopify storefront review (private pilot) | quoted on request | Bounded review of the public storefront and agreed app or API surfaces, after scope and authorization review |
| Orvyn: AI agent security test (private preview) | quoted on request | Agreed attack scenarios against your AI agent, reproduced findings with trace, impact and fix criteria |
Prices are per agreed month and exclude VAT. There is no per-month signature or separate work order: one signed agreement covers every test named in it.
Market prices
What does a pentest cost on average in the Netherlands?
Most Dutch pentest providers bill per test day, typically €1,000 to €2,000 excluding VAT. A small web application takes three to five days; a medium application with user roles and an API takes five to ten. A one-off pentest of a typical web app or API therefore costs roughly €4,000 to €15,000. A retest is sometimes included and sometimes charged extra.
| Type of test | Test days | Typical price | Source |
|---|---|---|---|
| Small test, about one day | about 1 | around €1,000 | KvK |
| Small web application | 3–5 | €4,000–€7,000 | Secure Audit |
| Web application with an API and user roles | 5–10 | €7,000–€15,000 | Secure Audit |
| API only | 2–7 | €3,000–€10,000 | Securiguide |
| Fixed entry package, small scope | 2–3 | from €2,500 | Re-sync |
Ranges as published by the sources, checked on 5 November 2026, excluding VAT where the source states it.
LOKI prices per agreed month instead of per day: from €500 excluding VAT for one web application or API, retest included. Up to 10,000 AI agents do the testing hours and a person checks every finding. Twelve monthly test cycles cost €6,000 a year, within the range of one traditional test of one web app.
What drives the price
Scope decides the quote, not the hours.
- Number of applications and APIs
- One web app or API is the €500 starting point. Several applications, or an app plus its API, are scoped and priced together.
- Roles and authenticated areas
- Customer portals, admin panels and multi-tenant setups add roles to test. We work with dedicated test accounts you provide.
- API surface and integrations
- A large API, webhooks or third-party integrations widen the scope. We agree what is in and out before quoting.
- Timing and evidence needs
- A release deadline, a customer questionnaire or NIS2 / ISO 27001 evidence shapes the window and the report, not the hourly rate.
Always included
What every SKYEN month contains.
- A written scope: target, exclusions, method and safe-test rules
- Up to 10,000 AI agents attacking the target, then a person checking every finding
- A report with reproducible evidence, business impact and the fix for your engineers
- One scoped retest after your fix, with the result in the report
- Dated, reproducible findings you can use as technical evidence for NIS2, the Dutch Cybersecurity Act or ISO 27001. Not a certificate.
Scan or pentest
Why a €500 pentest is not a €50 scan.
A vulnerability scanner lists known issues: outdated software, missing headers, common misconfigurations. A pentest chains findings, tests authorization and business logic and proves impact with evidence, and a person decides what is real before it reaches your report. The scanner is useful hygiene; the pentest is what an auditor, a customer or your own engineers can act on.
Questions about cost
- What does a pentest cost on average?
- At Dutch providers a one-off pentest of a web app or API usually costs €4,000 to €15,000 excluding VAT: three to ten test days at €1,000 to €2,000 a day. A small one-day test starts around €1,000. At LOKI a human-reviewed web app or API test starts at €500 per month excluding VAT, retest included.
- Is €500 the total price?
- €500 per month excluding VAT is the starting price for one web application or API. Larger or more complex systems get a fixed written quote; there are no hourly surprises.
- Can I do a single test instead of a monthly agreement?
- SKYEN is built around one bounded test per agreed month. Tell us your situation in the quote request; the written proposal states exactly what is covered and for how long.
- How long does a test take?
- About 10 working days once scope, access and test rules are complete. The date is confirmed with you in writing.
- Is a pentest required for NIS2 or the Dutch Cybersecurity Act?
- The law asks for suitable and proportionate measures and for evidence that they work; it does not name a pentest as such. A bounded web or API test is a common way to provide that technical evidence. The report is evidence, not a certificate.
- How do I get a quote?
- Use the form, call the phone line or ask Max in the site chat. We reply within one business day with a scoped proposal and a fixed price.
Get a fixed price for your scope.
Tell us the website, API or app and what you want to learn. You get a scoped proposal with a fixed price within one business day.