Penetration testing that finds what scanners miss.

Every engagement is a fixed fee after a free scoping call. Starting prices for the smallest scope: web applications from $5,000 per application (including its own API), external network tests from $5,000, APIs from $8,000 per API, AI features from $5,000, and cloud environments from $10,000 per environment. Your price depends on the applications, user roles, API endpoints, IP addresses, or cloud accounts in scope, and it won’t change once testing starts unless the scope does. One retest of reported findings within 90 days of the final report is included.

Starting prices in US dollars for the smallest scope of each service, reviewed October 2026. Your price is a fixed fee, set in a written proposal after a free scoping call.

See starting prices for every service

Testing can usually start within 5 business days of signing. Most web application, API, and network tests take one to three weeks of testing. Start dates are agreed during scoping, so tell us your deadline when you ask for a quote.

A scan is automated: it checks your systems for known issues. A penetration test adds testers who confirm what’s actually exploitable, test authorization and business logic, and chain small issues into real attack paths. NIST SP 800-53 Rev. 5 (CA-8) says penetration testing “goes beyond automated vulnerability scanning.” We still run scanners in every pen test for breadth.

Source: NIST, SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, control CA-8 (2020) (PDF)

Read the full comparison: penetration test vs. vulnerability scan

Our own US-based testers. We never pass your test to another firm. Each tester is an individual contractor engaged directly by HackNow, LLC under a written agreement. Certifications held across our testing team include OSCP, CRTO, CISSP, CCSK, and CompTIA PenTest+. Our testers have delivered 100+ penetration tests over their careers, including engagements for partner security firms.

Testing is planned to avoid disruption. We agree on testing windows, source IP addresses, and emergency contacts before we start. Denial-of-service and destructive testing are never performed without written approval, and you can pause testing at any time with one message. If anything we do seems to affect a system, we stop testing and call your emergency contact before we continue. If you have a staging environment that mirrors production, we’re happy to test there.

Reports document the scope, methodology, and dates that assessors typically look for. You also get an attestation letter to share with customers, auditors, or your insurer without handing over the full technical report. Your auditor decides what evidence it accepts. A full sample report, for an invented client, is available on request.

Ask for it: a sample report

Yes. One retest of reported findings within 90 days of the final report is included in the price. We verify each fix and issue an updated report and attestation letter. Phishing campaigns don’t include a retest.

Yes. We’ll sign a mutual NDA before scoping, or send ours. Evidence is handled under the confidentiality and retention terms in your contract, and we access sensitive data only as far as needed to prove impact.

Send an NDA before we discuss details How we handle your data

No test can promise that. A penetration test is a time-boxed assessment of the agreed scope at a point in time. We focus testing time where the risk is highest and report everything we confirm.