Penetration testing cost in Canada

Quotes for the same application routinely differ by a factor of five. Almost all of that variance comes from three things: how many tester days are in the engagement, what methodology is being followed, and whether a retest is included.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

A penetration test in Canada usually costs between $6,000 and $40,000 CAD. A single external network test on a small footprint sits near the bottom of that. An authenticated test of a multi-tenant SaaS product with an API sits in the middle. A red team engagement sits well above it. Below is the full breakdown by test type, and then the part that matters more: why one firm quotes $8,000 for work another firm quotes $28,000 for.

Price by test type and scope

Every number is Canadian dollars, and every one is a range for a first-time engagement at a mid-market Canadian firm. Boutiques and independents come in lower. National accounting firms and the security arms of the large consultancies come in higher, sometimes by half again, largely because of overhead rather than tester quality.

Where a quote lands inside its range is worth asking about directly. A firm that cannot explain the difference between its low end and its high end is pricing off a menu rather than off your scope.

The number underneath every quote

Penetration testing is priced in tester days. Almost every fixed-fee quote you receive is a day count multiplied by a rate, with a margin applied and the arithmetic hidden. Canadian day rates generally run $1,500 to $2,800 CAD per consultant, with independents at the low end and large-firm practices at or above the high end.

Divide the quote by a plausible day rate and you get the honest scope. A $6,000 CAD quote is three days of work, at most, including reporting. Three days is enough to test a small external perimeter properly. It is not enough to test a SaaS platform with role-based access control, so if that is what you are buying, the difference has to come out of somewhere, and it comes out of depth.

What actually drives the price

Scope size, counted the way a tester counts it. Not "one application". The units that matter are distinct user roles, distinct tenants, number of API endpoints, number of live hosts, and how many of those are genuinely different from each other. Fifty near-identical hosts behind one load balancer is a smaller job than five hosts running five different stacks.

Authenticated or not. This is the largest single multiplier in application testing. An unauthenticated test looks at what an anonymous attacker sees. An authenticated test has to be run once per role, and then across roles to check that a low-privilege user cannot reach a high-privilege function or another tenant's data. Three roles is roughly three times the testing surface, not three extra hours.

Methodology and evidence depth. A firm working to a published methodology such as the OWASP testing guide, the PTES stages, or the NIST SP 800-115 structure has to actually walk the checklist and show its coverage. That takes longer than freestyle poking, and it is what makes a report defensible to an auditor who asks what was tested and what was not.

Retest included or not. A retest is typically ten to twenty percent of the original engagement if bought separately, and it is the piece auditors most often want. Some firms include one within thirty days, some within ninety, some not at all. Two quotes that look $4,000 apart can be identical once you add the retest to the cheaper one.

Reporting standard. Ask whether you get a full technical report, an executive summary, and a shareable attestation letter. The letter is the artifact you hand to a customer's procurement team so you do not have to send them a document listing your unfixed vulnerabilities. Firms that do not produce one are creating a problem for you later.

Timeline. Rush work carries a premium, commonly fifteen to thirty percent, because it displaces booked work. Good Canadian testers are often booked four to eight weeks out, and the end of a quarter is worse. If your audit window closes in three weeks, that is a budget line, not a scheduling detail.

What a quote should include before you compare it

• The number of tester days and how they split between testing and reporting.
• The methodology being followed, named rather than described.
• Whether testing is authenticated, and how many roles are covered.
• Whether a retest is included, and the window it must be used in.
• What deliverables you get: technical report, executive summary, attestation letter.
• Who owns the report and whether you may share it with customers.
• Rules of engagement, including testing hours and the escalation contact.
• Whether findings are re-verified manually before they appear in the report, or lifted from tool output.

Two quotes are only comparable once all eight are answered. In practice about half the gap between a cheap quote and an expensive one disappears the moment you normalize for retest and role coverage. The other half is real, and it is depth.

Costs that are not in the quote

The engagement fee is not the whole spend. Budget for remediation engineering time, which for a first test is routinely more expensive than the test itself, because a first test finds years of accumulated decisions. Budget for a retest if one is not included. Budget for the internal hours spent scoping, provisioning test accounts, and sitting on kickoff and readout calls, which is usually a week of someone's attention spread across a month.

If the test is being bought for an audit, the test fee sits alongside the audit fee rather than replacing any part of it. A first SOC 2 engagement and the penetration test it requires are separate purchases from separate providers, and they must be, because the independence is the point.

How to spend less without buying less

Reduce scope honestly rather than asking for a discount. One well-tested application beats three superficially tested ones, and an auditor will accept a scoped test with a written rationale for what was excluded far more readily than a thin test of everything.

Fix the cheap findings before the test starts. Patch levels, TLS configuration, default credentials and exposed admin interfaces are things a scanner finds in an hour. Paying a senior tester to rediscover them is spending day rate on work a free tool does, and it crowds out the hours that would have gone into your authorization model.

Supply documentation and working test accounts on day one. Testers lose real time to accounts that do not work, environments that fall over, and a missing API specification. Every hour lost to setup is an hour not spent testing, and you are paying for it either way.

Common questions