The price of a pentest depends on what you test, how often and what you receive at the end. Below you will find TRU’s starting prices, the factors that change the cost and the information we need for an exact quote.
Starting prices
| Service | Starting price | What it assesses |
|---|---|---|
| Internal PenTest | from €31 per IP per month | Attack paths in the internal network, with grey-box testing included, within the authorised scope. |
| External PenTest | from €313 per IP, with monthly testing | The surface exposed to the internet, for the addresses and services in scope. |
Prices are in euros and exclude VAT. The service details are on the PenTest page.
The final price depends on the exact scope. Tell us how many IP addresses you want to test and how often, and we will send you a tailored quote.
Request a tailored quoteWhat affects the price
- The number of IP addresses. This is the main unit of calculation, separately for the internal and the external network.
- The type of testing. External and internal testing assess different surfaces and are priced separately. Internal testing includes grey-box testing: an assessment with a level of access and information agreed before the project.
- The frequency. Testing can be monthly, quarterly, half-yearly or annual, and the frequency you choose affects the price.
- The scope and conditions. The environments included, the testing windows and the operational restrictions are agreed before the quote.
Some areas are not part of network testing and are discussed separately: the code and logic of web applications, APIs or OT environments.
What the price includes
- An executive report for management and a technical report for the IT team, under CREST accreditation.
- Reports delivered within 48 hours after the scan finishes.
- Remediation recommendations, ordered by priority.
- Free retest after remediation, within the agreed scope and on the agreed date.
You can browse the sample reports before requesting a quote.
Monthly, quarterly or annual?
A test shows the state of the network at the time of the assessment. If your infrastructure changes often, if new systems are exposed to the internet or if you need regular evidence for NIS2, monthly testing gives you an up-to-date picture and tracks remediation from one test to the next.
For a stable infrastructure, a quarterly or half-yearly frequency may be enough. We agree the frequency together, based on exposure and business impact.
PenTest reports and retest results are also useful evidence for the NIS2 self-assessment under DNSC Order No. 1/2026 (in Romanian).
What to prepare for a quote
- The approximate number of internal and external IP addresses.
- The environments in scope and any exclusions.
- The frequency you want and the start date.
- Operational restrictions, for example the time windows when testing is not allowed.
- The contact person in the IT team.
Do not send passwords or administrative access through the contact form. For a first quote, the approximate size and the target date are enough.