Pricing / EUR, excluding VAT
Penetration testing cost and pricing (2026, EUR)
A web application or API penetration test in the Netherlands typically costs EUR 5,000 to 15,000 excluding VAT1; published Dutch day rates run from about EUR 1,000 to 2,0002. At Scotoma that is 4 to 10 tester days at EUR 1,250 to 1,500 per day.
AI Pentest
For chatbots, RAG and agents.
From EUR4,000
- Typically 3 to 10 testing days
Stack Pentest
For web apps, APIs and cloud.
From EUR5,000
- Typically 4 to 10 testing days
Launch Clearance
For SaaS shipping AI.
EUR10,000 to 20,000
- Typically 8 to 14 testing days
One scope, one report, and the issues that only show up when both layers are tested together.
§02 / Packages
What each test costs, and what moves the price
Each range is the band a quote lands in. Where in the band depends on the few things listed beside it, so you can place yourself before we speak.
AI PentestChatbot & RAG
A customer-facing assistant, an AI search or a RAG application.
Chatbot & RAG in detail- Range, excl. VAT
- EUR 4,000 to 10,000
- Testing days
- 3 to 7
What we test
- Prompt injection, direct and through retrieved content
- System prompt and data leakage
- Retrieval and tenant isolation in the vector store
- Output handling before it reaches code or browsers
- Consumption limits (denial of wallet)
What moves the price
- How many assistants and data sources
- Black box, or grey box with the system prompt
- Conversation flows with real effects
AI PentestAgent & MCP
An agent that calls tools, holds credentials or runs on MCP servers.
Agent & MCP in detail- Range, excl. VAT
- EUR 6,000 to 15,000
- Testing days
- 4 to 10
What we test
- Everything in Chatbot & RAG
- Tool and function calls kept within the task
- Agent identity and delegated credentials
- MCP servers and tool definitions, yours and third-party
- Memory and shared context integrity
What moves the price
- How many tools, and what they can change
- MCP servers in scope
- Hand-offs between agents
Launch ClearanceSaaS + AI feature
Your SaaS platform and the AI feature on it, as one scope.
SaaS + AI feature in detail- Range, excl. VAT
- EUR 10,000 to 20,000
- Testing days
- 8 to 14
What we test
- The AI feature, as in Agent & MCP or Chatbot & RAG
- The web application and APIs under it, as in Web & API
- Cross-layer findings: where a model issue reaches a stack issue
- One kickoff, one report, one attestation letter
What moves the price
- Chat only, or tools that act
- The size of the platform’s API surface
- Roles and tenants
- Range, excl. VAT
- EUR 5,000 to 15,000
- Testing days
- 4 to 10
What we test
- Authentication and sessions
- Authorization and tenant isolation
- Business logic and multi-step workflows
- API risks mapped to the OWASP API Security Top 10 (2023)
- Severity in CVSS v4.0
What moves the price
- Roles, tenants and workflows
- Endpoints and integrations
- Black box or grey box
Stack PentestCloud & Infrastructure
AWS, Azure or GCP accounts, and the hosts you expose.
Cloud & Infrastructure in detail- Range, excl. VAT
- Quoted per scope
- Testing days
- Per scope
What we test
- Identity, roles and privilege paths
- Storage exposure and access policies
- Secrets in code, images and pipelines
- Workload identity and metadata access
- External hosts and remote access
What moves the price
- Accounts, subscriptions and regions
- Services in use
- A configuration review, an outside view, or both
§03 / The gap
Why a human-led test costs more than an automated one
Automated tests now sell for EUR 1,250 to 3,500 a test3. They are worth running. Ours costs more because the price buys a person’s hours, spent where tooling tends to stop: business logic that only breaks in the third step, chained abuse that turns three small issues into one real risk, an agent calling a tool on a stranger’s say-so, a record that crosses from one tenant to another.
Your budget buys thinking time, not scanning time.
§04 / After the report
The retest, and the tests you keep
A finding is not closed when the report lands. It is closed when the fix holds.
- HiddenBefore the test: in your system, unseen.
- FoundReproduced, rated and written up.
- FixedReplayed after your fix. It holds.
- KeptRerun on your next release.
What is in the regression pack
- Stack findings
- The exact HTTP requests, as a collection your team can replay.
- AI findings
- The prompt sets, injected documents and tool-call traces, with the model and settings recorded.
- Your next release
§05 / Terms
Fixed quotes, payment and VAT
- The quote
- Book a 30-minute scoping call. A quote follows the call.
- Fixed means fixed
- Payment
- Payment terms are in the quote.
- VAT
- Every price on this page excludes VAT. Prices are in euros.
§06 / Questions
Questions about the price
What drives the price of a penetration test?
Mostly the number of things a person has to understand: roles, tenants, workflows, API endpoints, and for AI, the tools an agent can call and the data it retrieves. Black box testing takes longer than grey box for the same coverage. Production-only testing adds a little time for safer pacing.
How many testing days does a pentest need?
A single web application or API usually needs 4 to 10 testing days. A chatbot or RAG application needs 3 to 7, an agent with tools and MCP servers 4 to 10, and a SaaS platform with its AI feature 8 to 14. The scoping call turns that range into one number.
Why do you publish prices at all?
Because you need a number before you can ask for budget, and a range you can check is more useful than a sales call. Our ranges are the bands our quotes land in. If your scope sits outside them, we say so on the call, before any work starts.
Do your prices include VAT?
No. Every price on this page excludes VAT and is in euros. Your quote states the VAT that applies to your organisation and the country it is registered in. The date at the top of this page says when these ranges last changed.
See the format before you buy it
The sample report shows what the price buys, page by page. The method and the rules of engagement say how we work and what we will never do.