Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
An engineer in headphones works at a standing desk with two monitors by a high window.

Penetration testing pricing in South Africa: what drives the cost

Last reviewed: September 2026

Penetration testing pricing in South Africa follows scope: how many systems are tested, which types of test, how deep the testing goes and whether a retest is included, which together set the tester-days required. Arke Technologies, in Johannesburg, scopes, performs and retests penetration tests for organisations, public bodies and schools.

Request a security assessmentSee penetration testing
Insights

Penetration testing pricing in South Africa: what drives the cost

Last reviewed: September 2026, 14 min read

Penetration testing pricing in South Africa follows scope: how many systems are tested, which types of test, how deep the testing goes and whether a retest is included, which together set the tester-days required. Arke Technologies, in Johannesburg, scopes, performs and retests penetration tests for organisations, public bodies and schools.

Last reviewed: September 2026, 14 min read

On this page

What is penetration testing?

Penetration testing is an authorised, simulated cyber attack on your systems, carried out to find the weaknesses a real attacker would use and to prove where they lead. The penetration testing meaning lies in that proof: a scanner lists possible problems, while a penetration test shows which ones can be exploited and how far an attacker would get. A sound penetration testing definition adds three conditions: written permission, an agreed scope and a report.

What is a pen tester? A pen tester, or penetration tester, is the security professional who plans and runs the test, uses the same tools and techniques as criminals, and writes up the findings. What is penetration testing in cyber security terms? It is the testing side of a security programme: firewalls, monitoring and policies are the controls, and a penetration test checks that they hold. And what is penetration testing in ethical hacking? It is ethical hacking at its most structured: time-boxed, scoped and documented.

Our guide to what cyber security is explains the wider programme, and our penetration testing page sets out what we test. This article, one of our insights and guides, focuses on what a test costs and why.

An analyst reviews monitoring dashboards on two monitors in an open-plan office.

Penetration testing vs vulnerability assessment (VAPT)

What is vulnerability assessment and penetration testing? VAPT is the combined service: a vulnerability assessment finds known weaknesses across many systems, and a penetration test proves which of them matter. The vulnerability assessment and penetration testing difference is breadth against depth, and it is also the biggest difference in price.

Vulnerability assessmentPenetration test
Question answeredWhich known weaknesses exist?What could an attacker actually do with them?
MethodMostly automated scanning, then expert reviewManual testing, guided by tools
CoverageBroad: every host in scopeDeep: chosen targets and attack paths
OutputA list of findings rated by severityProven attack paths with evidence and business impact
Typical frequencyMonthly, quarterly or continuousCommonly once a year and after major change
Relative costLower per systemHigher, because it is driven by tester time

The vulnerability assessment vs penetration test decision is rarely either-or. Continuous scanning with a periodic penetration test suits most mid-sized organisations, and a vulnerability assessment and penetration test bought together often costs less than two separate engagements, because the scan shows the tester where to look. Our cybersecurity assessment and audit service covers the scanning side.

Vulnerability assessment and penetration testing tools come from the same families for both jobs: network scanners, web application proxies, password-auditing tools and exploitation frameworks, many of them open source. Commercial licences are modest next to the labour: most of the cost of a penetration test is the tester's time and judgement.

Penetration testing types

Penetration testing types are defined by the target and by how much the tester knows in advance. Each type is scoped, and priced, separately.

  • External network

    Internet-facing systems: firewalls, VPNs, remote-access portals, mail servers and any exposed services.

  • Internal network and Active Directory

    What an attacker could do after gaining a foothold, such as one phished laptop: moving across the network, escalating privileges and reaching domain administrator.

  • Web applications

    Portals, websites and online services, tested against OWASP guidance for authentication, sessions, access control, injection and business logic. Web application penetration testing cost rises with the number of user roles and functions.

  • APIs and mobile apps

    The interfaces behind apps and integrations, and the apps themselves.

  • Cloud

    Identity, storage exposure and misconfiguration in Microsoft Azure, AWS, Google Cloud and Microsoft 365.

  • Wireless and people

    Wi-Fi security and guest-network separation, and phishing simulations that test staff rather than systems.

The approach matters as much as the target. In a black-box test the tester starts with no information; in a grey-box test they have a user account; in a white-box test they have documentation and sometimes source code. Grey-box and white-box tests usually find more in the same number of days, which makes them better value for most organisations.

Penetration testing pricing: what drives the cost

Last reviewed: September 2026.

Penetration testing cost is mostly people's time. A provider estimates the tester-days the scope needs, adds reporting and retesting, and quotes a price for the project. That is why the question "how much is a pen test?" draws answers that differ widely, and why only a scoped quote is reliable.

Cost driverWhy it changes the priceHow to keep it in check
Number of targetsEach IP address, application, API or cloud account adds testing timeTest what faces the internet or holds sensitive data first
Type of testInternal and Active Directory tests take longer than an external perimeterMatch the type of test to the risk you are worried about
Application sizeUser roles, functions and integrations multiply the test casesProvide a test account for each role and a list of key functions
ApproachA black-box test spends days on discovery; a grey-box test starts insideGive the tester credentials and documentation
Testing windowsOut-of-hours or weekend testing to protect production adds costOffer a staging environment that mirrors production
Compliance requirementsPCI DSS, an insurer or a tender can fix the method and report formatShare the requirement at scoping, not afterwards
RetestConfirming each fix takes additional tester timeAsk whether a retest is included, and for how long
ReportingBoard summaries and audit evidence take time to writeAgree who will read the report before the test starts

What about penetration testing cost per hour? Testers are usually costed by the day rather than by the hour, and a quote is normally a price for the agreed scope rather than a bill for time as it runs. A price agreed up front protects you from overruns; check what happens if the scope changes during the test.

Be wary of pen testing cost that looks too low. A cheap test is often an automated scan with a new cover page: it misses logic flaws, chained weaknesses and anything that needs a person to notice, and it often reports false positives your team then spends days chasing. The opposite mistake is paying for depth you do not need, such as a full internal test when the real concern is a single citizen or customer portal.

We quote every penetration test per project after a scoping call, with the targets, method, exclusions, reporting and retest written into the quote, so you can compare like with like. Our guide to managed IT services cost shows how ongoing security fits into a managed budget.

Penetration testing vs ethical hacking, bug bounty and other testing

Buyers comparing options meet several neighbouring terms. Each answers a different question and is paid for differently.

TermWhat it isHow it is paid forHow it relates to a penetration test
Ethical hackingThe wider practice of authorised hacking to improve securityVaries by engagementA penetration test is ethical hacking with a fixed scope, a time box and a report
Red teamingA longer, goal-based simulation of a determined attacker that tests detection and response as well as defencesPer engagement, usually more than a penetration testSuits organisations that already test regularly
Bug bountyIndependent researchers report vulnerabilities in return for a reward per valid findingPer finding, plus the cost of running the programmeComplementary: a bounty works best once testing has removed the obvious flaws
Performance testingLoad and stress testing of speed, stability and capacityPer projectDifferent goal: it finds breaking points, not security flaws
Cyber securityThe whole discipline of protecting systems and dataOngoingPenetration testing is one activity within it

Penetration testing vs ethical hacking is therefore a question of structure, not technique. Penetration testing vs bug bounty is a question of maturity: a bounty pays per result and never ends, which suits organisations whose basics are already sound. A bounty programme in South Africa also needs careful written terms, because the Cybercrimes Act 19 of 2020 makes unauthorised access a crime and researchers need clear authorisation for what they may test. Penetration testing vs performance testing and penetration testing vs cyber security are not real alternatives: performance testing answers a capacity question, and cyber security is the whole programme a penetration test checks.

A penetration testing strategy: what to test, and how often

A penetration testing strategy spends the budget where the risk is. A practical cycle for a mid-sized organisation, public body or school:

  1. Test the internet-facing perimeter every year, and after major changes such as a new firewall, VPN or remote-access service.

  2. Test critical applications before they go live and after significant releases, especially portals that hold personal information or take payments.

  3. Test the internal network and Active Directory periodically, rotating the scope so every area is covered over a cycle.

  4. Scan continuously in between, so known weaknesses are fixed before the next test and the tester's days go on what scanners miss.

  5. Retest every fix, and track open findings to closure in your service reviews.

Some rules make the cycle concrete:

  • PCI DSS requires internal and external penetration testing at least once every 12 months and after significant changes wherever card data is processed.
  • Joint Standard 2 of 2024, issued by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority and in force since 1 June 2025, requires banks, insurers, pension funds, collective investment scheme managers and the other financial institutions it covers to test critical systems at a frequency set by their risk, and internet-facing systems after every major change and at least once a year; see IT for financial services.
  • ISO/IEC 27001:2022 expects technical vulnerabilities to be managed (control 8.8) and security to be tested during development and acceptance (control 8.29); see our guide to ISO 27001 certification.
  • POPIA section 19 requires organisations to verify regularly that their security safeguards are effectively implemented, and a penetration test is direct evidence of that; see the POPIA compliance checklist.

What a vulnerability assessment and penetration testing report should contain

The report is what you are paying for, so ask to see a redacted sample before you buy. A good vulnerability assessment and penetration testing report contains:

  • An executive summary a board or council can read: overall risk, the most serious findings and what to fix first.
  • The scope, method, dates and any limits on testing.
  • Each finding with a severity rating, commonly on the Common Vulnerability Scoring System (CVSS), with evidence, the affected systems and the steps to reproduce it.
  • Attack paths that show how individual findings chain together.
  • Prioritised remediation advice for your technical team.
  • Retest results recorded against each finding.

The report, the evidence and the retest results are yours to keep and to give to auditors, insurers or a tender panel, including after any agreement with us ends.

How to compare penetration testing quotes

  • Is the scope the same? Compare targets, test types and approach, not only the total.
  • Is it manual testing, or a scan with a report? Ask how many tester-days are included and what is done by hand.
  • Who tests, and who checks the work? Ask about experience and certifications such as OSCP or CREST, and who reviews each finding before it reaches you.
  • Is a retest included, and within what period?
  • How is your data handled? POPIA applies to any personal information a tester sees.
  • Does the provider meet your procurement requirements? Arke Technologies is a Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, our CSD number and tax compliance status are available on request.

Our guide on how to choose an IT company covers the wider procurement questions.

How we scope, test and price a penetration test

  1. Scoping call

    What you want tested and why: a compliance requirement, a new system, an insurer's question or a board's concern.

  2. Written scope and quote

    Targets, exclusions, approach, testing windows, reporting and retest, priced per project.

  3. Authorisation

    Your written permission and rules of engagement before any testing starts; testing without it would be unlawful access under the Cybercrimes Act.

  4. Testing

    Reconnaissance, scanning and controlled exploitation within the agreed limits. Any sign of a real compromise moves straight to incident response.

  5. Report and debrief

    Findings explained to your technical staff and to management.

  6. Remediation support and retest

    We help your team fix the findings, then retest each fix.

For clients under a managed agreement, open findings are tracked in the monthly service review until they are closed, so the audit committee sees progress in line with King V Principle 10 and, for public bodies, PFMA or MFMA risk-management duties. A test can be bought on a proposal, a purchase order or a tender response, and everyone with access to your systems is bound by confidentiality and our security controls.

Related services

Related guides

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Topics (optional)

Leave these clear to receive everything.

By signing up, you agree that Arke Technologies (Pty) Ltd may email you guides and updates. Every email includes an unsubscribe link. Read our privacy notice.

Frequently asked questions

How much does a penetration test cost in South Africa? Show answer

A penetration test in South Africa costs whatever its scope requires in tester-days, so a single web application costs far less than an internal network with Active Directory and cloud services. The main drivers are the number of targets, the type and depth of testing, testing windows, reporting and the retest. A written quote after scoping is the only reliable number.

What is the difference between VAPT and a penetration test? Show answer

VAPT combines two services: a vulnerability assessment, which scans broadly for known weaknesses, and a penetration test, which proves which weaknesses an attacker could exploit. A penetration test on its own goes deep on chosen targets; VAPT adds breadth. Buying both together often costs less than two separate engagements, because the scan shows the tester where to focus.

How long does a penetration test take? Show answer

A penetration test takes from a few days for a single web application or external perimeter to several weeks for a large internal network, depending on scope. Scoping, scheduling and written authorisation come first, and the report and retest follow the testing. Ask for the testing dates, the report date and the retest window in the quote.

Is penetration testing a legal requirement in South Africa? Show answer

Penetration testing is not a general legal requirement in South Africa, but banks, insurers, pension funds and the other institutions covered by Joint Standard 2 of 2024 must test, and other obligations make it close to essential. POPIA section 19 requires regular verification that security safeguards work, PCI DSS requires testing at least every 12 months wherever card data is processed, and tenders, auditors and cyber insurers often ask for a recent report.

Who is responsible for penetration testing? Show answer

The organisation that owns the systems is responsible for commissioning penetration tests and fixing the findings, while the tester is responsible for testing safely, within scope, and reporting accurately. Usually the IT director or CIO sponsors the test, a system owner signs the authorisation, and the board or audit committee follows remediation through to closure.

How often should an organisation have a penetration test? Show answer

Most organisations should commission a penetration test at least once a year and after any major change, such as a new system, a firewall replacement or a significant application release. Card data brings a 12-month minimum under PCI DSS, and the financial institutions covered by Joint Standard 2 of 2024 must test internet-facing systems at least annually. Continuous vulnerability scanning between tests keeps each test focused and its cost down.

Is AI replacing penetration testing? Show answer

No. AI tools now help testers with reconnaissance, triage and report drafting, which can shorten a test and lower its cost, but they do not replace the tester. Chaining weaknesses into a realistic attack, judging what is safe to try on live systems and explaining the business impact to your board still need an experienced person.

Get a written scope and quote

Tell us what you want tested and why, and we will send a written scope and a quote for the project. Call 010 447 2445 or talk to us.

Request a security assessment