Penetration Testing Cost in Canada: A Plain-English Guide

An import company in Montreal's Saint-Laurent district asks two firms to quote a "penetration test." One quote comes in at a fifth of the other. Same words, same company, two completely different products.

That's the core problem with this market. "Penetration test," or "pentest," can mean anything from an automated scan that runs in an hour to weeks of hands-on work by specialists. For a business owner, it's hard to know what you're actually buying.

This guide explains what a penetration test really is, what the main types cost in Canada and how to compare quotes without getting burned.

What a penetration test actually is

A penetration test is a simulated attack against your systems, carried out by specialists. The goal isn't just a list of weaknesses. It's proof of impact: "using this weak password, we read the finance team's email," for example.

There are three common approaches:

• Black box: the tester starts with nothing, like an outside attacker.
• Grey box: the tester gets a regular user account, like an employee or a customer would have. This is often the best value.
• White box: the tester has access to documentation and sometimes source code.

One point is non-negotiable: a penetration test requires written authorization from the owner of the systems. Without it, the activity can amount to unauthorized use of a computer under section 342.1 of the Criminal Code. If your website or application is hosted by a third party, check their terms as well; some providers have rules about testing on their infrastructure.

Main types of tests and what they cost

Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026: about $5,000 to $45,000, figures it describes as "illustrative"). They aren't market averages or fixed rates; the table shows where each type of test tends to fall, to help you sanity-check a quote.

External and internal tests answer different questions: "Can someone get in?" and "What can someone do once they're inside?" We compare them in detail in external vs internal penetration testing. For applications, see our guide to the web application penetration test and the OWASP Top 10.

What drives the price

Five factors explain most of the gap between quotes:

1. Scope size. The number of IP addresses, applications, user roles (customer, employee, admin) and physical locations.
2. Manual effort. Automated tools find known flaws. A human finds logic flaws, such as a customer who can view another customer's invoices by changing a number in the URL.
3. Operational constraints. Testing overnight or on weekends to avoid disrupting production costs more.
4. Retesting. Confirming that your fixes work is often billed separately. Ask for it explicitly.
5. The report. A useful report includes an executive summary, reproducible evidence and concrete recommendations.

Keep in mind that a pentest is a snapshot. It shows what a skilled attacker could do to your systems during a specific window, within the scope you approved. It won't catch a vulnerability published next month or a misconfiguration introduced by your next software update. That's why testing belongs inside a broader routine of patching, monitoring and periodic scans. A low quote isn't automatically a bad sign, but it should come with a smaller, clearly defined scope, not the same promise for less work.

How to compare quotes without getting burned

In the Saint-Laurent example, the gap usually has a simple explanation: the cheaper quote is an automated vulnerability scan sold as a penetration test. Scans have their place (we explain where in security audit vs pentest vs vulnerability scan), but they're not the same product.

Before you sign, check that the quote covers the following:

• A precise written scope: IP addresses, URLs, roles tested and exclusions
• A named methodology (for example OWASP, PTES or NIST SP 800-115)
• An explicit share of manual testing, expressed in person-days
• A retest, either included or priced
• A redacted sample report
• Written authorization and rules of engagement (testing hours, emergency contact)
• The names of the people doing the testing
• Professional liability insurance on the vendor's side

A vendor who won't clarify scope or show a sample report deserves a follow-up question or two.

What should a small business budget?

The right test depends on your exposure, not your revenue. Two fictional but typical examples:

A 15-person accounting practice in downtown Montreal. Everything lives in Microsoft 365, there are no on-premises servers and the website is a simple brochure site. A small external test, combined with a Microsoft 365 configuration review, covers the essentials. That keeps you at the low end of the ranges.

An 80-employee plastics manufacturer near Drummondville. Customers place and track orders through a web portal, and the plant network includes industrial controllers. Here, a grey-box web application test (using a customer account) plus an internal network test are justified. Expect the middle of the ranges, or higher depending on how many features the portal has.

Timing matters too. Schedule the test before a new application goes live, not three months after. Avoid your busiest periods (tax season for an accounting firm, the holiday rush for a retailer), since your team will need to answer testers' questions and fix critical findings quickly. And if your cyber insurance renewal is coming up, a recent report helps you answer the insurer's questionnaire with facts rather than guesses.

For perspective, industry data cited by Insurance Business Canada (October 2025) puts the average cost of a ransomware attack at $330,000 and of a data breach at $220,000. A test that prevents even one of those pays for itself many times over.

After the test: report, fixes and retest

A test is only worth what you do with it. Plan for:

• A report walkthrough with the testers so you can ask questions. Our guide on how to read a penetration test report helps you make sense of it.
• A prioritized remediation plan, with an owner and a due date for every critical or high finding.
• A retest a few weeks later to confirm the fixes hold.

Our team delivers penetration testing for small and mid-sized businesses, with a written scope, proper authorization and a retest built into the quote from day one.