Pricing a Vulnerability Assessment and Penetration Testing

Vulnerability assessment and penetration testing (VAPT) are vital activities in securing an organization’s information assets and IT infrastructures, which include communication networks, application solutions, computing endpoints (i.e. workstation Pcs, laptops, servers & mobile PDAs), business data/records, employee information, etc. Beyond the need to validate an organization’s adoption of cybersecurity best practices to reassure stakeholders, there is obligation to comply with extant laws and regulations in virtually every industry where personal identifiable information is collected, process, transmitted and stored. For example, vulnerability assessment and penetration testing are now a mandatory requirement for hospitals, financial institutions, telecommunication providers, public facilities & governmental agencies and service industry in general. This has brought about increase demand for VAPT service providers. While the demand for VAPT service has gone up, there are still gaps for stakeholders in determining a fair pricing structure suitable for both the service provider and the client organization.

How much can one expect to pay or bill for a vulnerability assessment? This question usually come up when price for VAPT are negotiated. This is however dependent on several factors ranging from complexity of the organization being assessed and its network environment, experience of the assessment/testing provider, cost of scanning tools used by testing provider (including license fees), the scope of the test as well as remedial actions arising from test outcome, among others. This section will attempt to dimension the various factors that go into pricing a vulnerability assessment & penetration test, instances of vulnerability assessment costs, as well as the gains of vulnerability assessments over other protection measures. As a client organization, figuring out what to pay for vulnerability assessment is often time very demanding and complex while as a VAPT service provider, you would not want to quote a bill that will alarm a client or push them to seek for alternatives.

The factor to consider most in determining the cost of vulnerability assessment is the complex nature of client organization and network environment. For organizations that have a complex and distributed computing network with several network devices, compartmentalized network segments, lots of endpoints (both servers & workstations) leading to more potential attack vectors, they will obviously fetch a much higher quote than an organization with less complex computing network with fewer devices and endpoints. Determining the cost of VAPT in this case will require the service provider to factor in the potential attack vectors, which for a complex organization will be more and challenging than the less complex ones.

Secondly, the scanning tools use by the service provider all forms part of the cost of the service, given that the fee being charged should be able to offset the cost of acquiring the tools and their licensing fees. Otherwise, it will not make any business sense to pay for software licenses without being able to offset the cost through jobs being undertaken. The experience of the VAPT service provider vis-à-vis the profiles of its clientele base also come to play. Where the service provider has enlisted high-profile clients and also enjoys vast volume of orders, it will most likely ask for a higher fee than when the reverse is the case.

Another determinant of the final fee for VAPT is the scope of the test, which often time in within the purview of the client organization to determine. The scope of the VAPT will largely influence the final quote to be given as the testing provider will have to tailor its billing to things that fall within the scope agreed for such engagement. However, allowing fear of high rate/fee to drive or determine what becomes the score of any vulnerability assessment & penetration testing engagement is obviously risky as there will be little or no room to actually bring out inherent vulnerabilities and control gaps within the operating environment due to the scope constraint.

As such, it is important to not limit the scope of VAPT to any specific environment or network segment especially for a more distributed/interconnected computing environment, where a minute or supposed insignificant weakness or risk in one segment of the network could lead to far-reaching consequences for the organization. Lastly, the testing provider may charge extra fee to repair/remediate any security flaws that were discovered during the engagement especially where there are little or no internal capacity to handle such.

What’s the average cost of a vulnerability assessment? The answer largely depends on the factors enumerated earlier. However, one might expect fee within the range of $4,500 to $6,000 for simple or less complex networks. For moderately complex organization with more diverse computing environment, a fee between $10,000 to $15,000 would be ideal but the penetration testing will cost you a much as $30,000 upwards. However, for large organizations with much more complex network and scale of distributed computing network environment, they could pay as much as $100,000, which is not too much to pay compared to the risk and consequences associated with a breach or attack when they occur.

As much as possible, organizations should weigh the value they have placed on their information assets (business data/information) as well as the investment in their IT infrastructures vis-à-vis the risk/consequences of any security breach. This will enable it to properly dimension whether the cost of any security assessment (e.g. VAPT) is worth the while or not. It is also to be noted that services that advertise significantly discounted rates may not actually provide much meaningful vulnerability assessments. Vulnerability assessment & penetration testing is a very important task for every organization required to do so by law or regulation as a result of its handling of personally identifiable information or card holder data.

It is therefore important for every organization seeking to perform VAPT to not just consider the cost but also look at the criticality of the exercise to its safety and that of its information assets. Being connected to the attack vectors increases the chance of an attack or breach crystallizing as such, it is imperative to always ensure that your information assets and operating environment are devoid of those vulnerabilities that hackers out there could exploit to cause harm to the organization. Hackers (whether internal or external) can do harm when they find any slightest opportunity for any flimsy reason or motive depending on what is driving such motive. As such, the least that can be done is to be ready for such attack by doing the required basics that prevent one from being targeted.

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.