Pricing a penetration test as a firm
Price from tester days and a rate you can defend, not from what you think the client will pay. The buyer-side pages on this site publish the same arithmetic, so a quote that does not survive it is a quote somebody is about to question.
A Canadian penetration testing day sells for roughly $1,500 to $2,800 CAD, with most boutique work landing between $1,600 and $2,600. Price the engagement as days times rate, show the days in the proposal, and stop negotiating the rate. Every discount conversation that starts on rate should be moved to scope, because a lower rate is permanent and a smaller scope is honest.
$1,500 to $2,800 Canadian tester day rate, CAD
60 to 70% Billable utilisation a healthy practice sustains
15 to 20% Of engagement days that are reporting, not testing
Where the day rate comes from
The rate has to cover a tester who is not billable all the time. Work it backwards from what you pay somebody and what fraction of the year they can sell.
| Line | Annual (CAD) |
|---|---|
| Salary, mid-level tester with three to six years | $95,000 to $135,000 |
| Employer costs, benefits and payroll burden at about 18 percent | $17,000 to $24,000 |
| Tooling, licences, lab and cloud | $6,000 to $15,000 |
| Training, certification renewal and conference | $5,000 to $12,000 |
| Insurance, accreditation, legal and accounting, per head | $4,000 to $12,000 |
| Share of sales, admin and management overhead | $25,000 to $60,000 |
| Fully loaded cost per tester | $152,000 to $258,000 |
Now divide by sellable days. There are about 250 working days in a Canadian year. Take off vacation, statutory holidays, training, internal work and the gaps between engagements, and 150 to 175 billable days is a realistic target, which is 60 to 70 percent utilisation. At $155 to $175 thousand of loaded cost against 160 billable days, your break-even is roughly $970 to $1,090 CAD a day. A $1,600 rate is a healthy margin. A $1,100 rate is a business that fails quietly the first quarter somebody is on the bench.
Utilisation is the number that kills small practices
Firms model 85 percent utilisation, price against it, and then discover that testers cannot bill while scoping, writing proposals, doing retests they quoted as free, or waiting two weeks for a client environment to be ready. Model 65 percent. If you beat it, that is profit rather than survival. Pricing a business on utilisation it has never achieved is the most common reason a boutique with plenty of work still runs out of cash.
Estimating the days, which is the actual skill
Rate is easy and days are hard. These are defensible starting points before scale and role complexity, and they match the figures published on the buyer side of this site. A client who read those pages will recognise them.
| Surface | Base days | What multiplies it |
|---|---|---|
| External network perimeter | 3 to 5 | Host count, live services |
| Internal network, assumed breach | 5 to 9 | Site count, domain size, VLAN count |
| Web application | 5 to 9 | Feature count, roles, tenancy model |
| API | 4 to 7 | Endpoint count, authorisation model depth |
| Cloud account review and testing | 4 to 7 | Account count, service breadth |
| Mobile, one platform plus backend | 5 to 9 | Second platform adds 40 to 60 percent |
| PCI segmentation testing | 2 to 4 | Number of segments and controls |
| Add on top of any of these | 1 to 2 days reporting, plus 0.5 to 1 day if a retest is included | |
Multipliers that hold up: roughly 1.5 for a medium scope against a small one, 2.2 for large, 3.0 for very large. Authenticated testing across two roles adds about 35 percent to an application engagement and three or more roles about 60 percent, because each additional role is another full pass over the authorisation surface. Those are the same coefficients the public cost calculator uses, so you can check your own quote against what the buyer will see.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Fixed fee, or time and materials
| Model | Use when | The risk you take |
|---|---|---|
| Fixed fee | Scope is bounded and countable: named hosts, one application, a defined role set | You eat the overrun. Price a contingency of 10 to 15 percent into the days |
| Time and materials with a cap | Discovery-heavy work, first engagement with a messy estate, incident-driven testing | Client anxiety. Report burn weekly and stop at the cap |
| Retainer, days per quarter | A client shipping continuously who wants testing between annual engagements | Unused days becoming a refund argument. Say up front whether they roll |
| Per-asset price list | High-volume small work sold through a partner or a platform | Adverse selection. The complicated assets arrive and the simple ones do not |
Fixed fee wins most competitive situations because buyers comparing three quotes want one number. That works as long as the scope in the statement of work is specific enough to point at when the client adds a second application in week one. Write the change-order trigger into the document rather than relying on goodwill.
What to price separately, and what to include
- Include the retest. One to three days of work, and quoting it separately reads as a lever the buyer will pay under pressure. Cap the window at 90 days and say so. It is the easiest way to look more honest than the competing quote.
- Include the attestation letter. It costs you twenty minutes and it is the deliverable the client's customer wants. Charging for it is remembered.
- Include a live readout. An hour with the engineers. It produces more renewal than any account management.
- Price travel separately and honestly. On-site internal or physical work outside your metro carries real cost. Show it as a line.
- Price out-of-hours testing separately. If the client needs a window outside business hours, that is a real premium of 20 to 40 percent, and saying so is better than absorbing it and resenting it.
- Never discount by removing the report. A cheaper engagement with a thinner report is the pattern the whole buyer side of this site warns against. Do not be the example.
When to quote the cheap thing on purpose
A prospect with a small perimeter, no application worth attacking and a questionnaire to satisfy does not need a $20,000 CAD engagement, and selling them one is how a practice acquires a client who never renews and tells people the test was not worth it. Quote the automated external testing they need at $2,000 to $5,000 CAD a year, say why it is the right purchase today, and name the trigger that would change your advice. You will get the call when the trigger fires.
Handling the price conversation
You will be compared against a $3,500 CAD quote. Do not attack the other firm and do not defend your rate. Put both quotes in tester days and let the buyer see that one of them is a day and a half of work. The buyer-side page vulnerability assessment against penetration test makes that argument in a way you can send rather than make yourself. It is more persuasive from somebody who is not bidding.
Where a buyer cannot afford the scope, cut the scope. Test the authenticated application and drop the external network to a scan. Test one platform and not both. Do the internal network next year. A smaller honest engagement produces a client. A discounted full engagement produces a precedent.
Publish what you charge
Listings that name surfaces, tester-day counts and turnaround convert better than listings that describe tailored solutions.
List your firmCommon questions
What should a penetration testing firm charge per day in Canada?
Between $1,500 and $2,800 CAD, with most boutique work at $1,600 to $2,600. Below about $1,100 a day you are not covering a fully loaded tester at realistic utilisation. Above $2,800 you are competing with accredited firms carrying brand and accreditation the buyer is also paying for, so be sure you have something specific to point at.
How do I estimate tester days for a quote?
Start from a base by surface, three to five days for an external perimeter up to five to nine for a web application or internal network, then multiply for scale and for the number of authenticated roles. Add one to two days of reporting and half a day to a day for the retest. Show the split in the proposal, because a buyer who can see the days can compare your quote with the cheap one.
Should I quote fixed fee or time and materials?
Fixed fee for bounded, countable scopes, which is most compliance-driven work and what buyers comparing quotes prefer. Time and materials with a cap for discovery-heavy first engagements against a messy estate. Whichever you choose, write the change-order trigger into the statement of work so scope growth is a document rather than an argument.
What utilisation should I assume when pricing?
Sixty to seventy percent. Testers cannot bill while scoping, writing proposals, running retests you included, or waiting for a client environment to be ready. Firms that price against 85 percent look profitable on a spreadsheet and run out of cash the first quarter somebody sits on the bench.
Should the retest be free?
Include it, cap the window at 90 days, and cover high and critical findings at minimum. It is one to three tester days, it is what buyers are told to ask for, and quoting it separately makes your proposal look like the one with a lever in it. Price a full-scope retest outside the window normally.