Why two firms quote different numbers
A quote is a bid on work nobody has done yet. Where the scope leaves something open, every firm fills the gap with its own assumption and prices it, which is why the same application comes back at $9,000 CAD from one firm and $24,000 CAD from another.
Two firms quote different numbers for the same test because they are not quoting the same test. Day rates across Canadian firms sit in a narrow band, roughly $1,500 to $2,800 CAD, so rate almost never explains a spread of more than about 40 per cent. Everything above that is days, and days come from what each firm assumed about the things your scope did not say. A firm that cannot see how many user roles exist assumes the worst case it can still win with, prices that, and adds a margin for being wrong. That margin is real money and you are paying it for a sentence you did not write.
$1,500 to $2,800 Canadian tester day rate, the part that barely varies, CAD
What each unknown costs you
Work down this table with your own scope document open. Every row you cannot answer in writing is a row somebody is pricing on your behalf.
| What the scope does not say | What a firm assumes | Effect on the quote |
|---|---|---|
| How many distinct user roles exist | Three or more, each tested separately | Adds 2 to 4 tester days |
| Whether credentials will be ready on day one | They will not be, and a day is lost | Adds a contingency day |
| Production or a staging mirror | Production, with rate limits and a change freeze | Adds coordination time, sometimes evening work |
| How many API endpoints are in scope | The largest count consistent with what you said | Scales almost linearly with days |
| Whether a retest is expected | It is, and it is not budgeted | Either a padded price or a change order later |
| Whether anyone has tested this before | Nobody has, so finding volume will be high | Adds reporting days, which are real days |
| Who signs off and how fast | Slowly, through a committee | Adds project management hours |
| What the report is for | An auditor will read it, so it must be defensible | Adds review and quality assurance time |
A tester who assumes the best case and is wrong eats the difference, and a firm that does that twice stops existing. The premium is rational. It is also avoidable: it is priced against your silence, not your environment.
The same application, two quotes, taken apart
A Canadian SaaS company sends a two-paragraph request to two firms: one web application, external testing, report needed for a customer. Here is what each one built.
| Line | Firm A (days) | Firm B (days) | Why they differ |
|---|---|---|---|
| Reconnaissance and mapping | 1 | 1 | Same work either way |
| Authenticated testing per role | 2 | 5 | A assumed one role, B assumed three |
| API surface | 1 | 3 | B assumed the API is in scope, A assumed it was not |
| Reporting and quality review | 1 | 2 | B assumed an auditor is the reader |
| Retest | 0 | 1 | A excluded it, B included it silently |
| Contingency | 0 | 1 | B priced the risk of being wrong about all of the above |
| Total | $10,000 | $26,000 | CAD, at the same day rate |
Firm A is quoting a smaller engagement, and the buyer will find that out in week two. The spread measures how much the request left open, and the fix is on the buyer's side of the table. The scope document is the whole remedy, and the quote checklist is what to compare once the quotes come back.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Three things people call the same word
- Rate variance
- Difference in what a firm charges per tester day. Real, narrow, and usually the least interesting part of a spread. Negotiating here gets you a cheaper tester, not a cheaper test.
- Scope variance
- Difference in what each firm believes it is testing. Usually the largest component, and entirely fixable by writing the scope down once and sending the same document to everyone.
- Uncertainty premium
- The days a firm adds because it might be wrong about the scope. Invisible on the quote, because it is folded into the line items rather than named. It shrinks when the unknowns shrink, not when you push on price.
The mechanism is not specific to pentesting
Anyone quoting fixed-price professional work against an environment they cannot see prices the uncertainty, and the estimate falls when the uncertainty does. Compliance audits are priced the same way. On one engagement handled by TrazTech, which operates this site, an audit firm revised a five-figure SOC 2 quote down by $11,000 CAD after the client's readiness position was documented and a prep firm was confirmed. Nobody asked for a discount. There was less uncertainty left to price. That was an audit rather than a penetration test and the number does not transfer, but the mechanism is the one operating on your pentest quotes.
The practical version for a buyer: information you hand over before the quote is worth more than pressure you apply after it. A firm that has to guess protects itself. A firm that does not have to guess has nothing to protect itself from.
Closing the gap before you ask for numbers
- Write down every hostname, IP range, application and API in scope, and state plainly what is out.
- Count the distinct permission levels and say whether credentials will exist for each on the first morning.
- Name the environment, and say what differs between it and production.
- Say who reads the report and why. An auditor as reader changes the reporting effort, and everyone should price it the same way.
- State whether a retest is in scope, so it is not a change order in week five.
- Ask for tester days rather than a single number, so the next spread you see is legible.
Firms differ on whether they will show you days. One that will not is asking you to compare totals built from assumptions you cannot see. The vendor questions page has the rest of what to ask.
Facts to supply before the first call
0 of 0 supplied ·
A spread that does not close
If you send one scope document to three firms and the quotes are still a factor of two apart, the remaining difference is usually methodology depth or seniority, not misunderstanding. Ask each firm how many days are manual testing against automated scanning, and who is doing them. A $4,000 CAD number for an application test is a scan with a report attached, sold against work that is not the same work.
Compare quotes built on the same scope
Send one description of the work and get numbers from Canadian firms that are quoting the same engagement.
Get matchedCommon questions
Is the cheapest pentest quote always the worst one?
No, but it is usually the smallest engagement. A low number is legitimate when the firm has understood a genuinely narrow scope and said so in the proposal. It is a problem when the firm reached it by assuming away work you actually need, because that work returns as a change order or as a report your auditor will not accept.
Should I tell firms what my budget is?
Tell them the scope and ask for tester days. A stated budget tends to become the price regardless of the work, which removes the information you were trying to buy. If you have a hard ceiling, say it after you have seen the days, and ask what would come out of scope to reach it.
Why do firms not just show their day count?
Some do, and it is a reasonable thing to insist on. Firms that resist are usually protecting a margin or a subcontracting arrangement, or they price by deliverable rather than by effort. Either is workable, but you cannot compare two quotes that are constructed differently, so ask every firm for the same shape of answer.
Does a bigger quote mean a more thorough test?
Only if the extra money is buying tester days on your systems. It might instead be buying project management, a longer report template or a contingency the firm expects not to use. Ask for the day breakdown and the split between manual testing and automated scanning, and the answer becomes visible.
How much can documenting the scope actually save?
There is no reliable figure, and anyone quoting one is guessing. What is predictable is the direction: a firm that has to assume the worst case prices the worst case, and a firm that has been told the real numbers does not. The saving is whatever the assumption was worth, which is why the spread between quotes is a better guide than any percentage.