Penetration test quotation template
Penetration test quotation template: scoping and rules of engagement, external tests per IP address, web application tests, the findings report and a retest.
Templates by industry
- Scoping call and rules of engagement
- External network test, per public IP address
- Web application test, per application
- Findings report with risk ratings
- Retest of fixed findings
Preparation guide
Example workflow
Confirm scope and quantities
Example: start with "Scoping call and rules of engagement", confirm the required quantity and client inputs, then agree completion criteria for each item.
Review and approve the quotation
Confirm acceptance evidence for "Retest of fixed findings", all line quantities, exclusions and quote validity with the customer, and retain the approved version.
Deliver and prepare billing
Link subject identifiers to results and deliver observations and agreed follow-up actions. When the agreed milestone is complete, prepare an invoice using actual quantities and approved changes.
A penetration test is an authorised attack on a client's own systems to find weaknesses before someone else does. What it costs depends almost entirely on scope: how many internet-facing addresses, how many applications and how deep the testing goes. This template starts with a scoping call that produces written rules of engagement, prices external addresses and applications per target, and keeps the report and a later retest of fixed findings on their own lines, so the client sees the whole cycle.
Fields to prepare
- Deliverables and line items
- Scoping call and rules of engagement, External network test, per public IP address, Web application test, per application, Findings report with risk ratings, Retest of fixed findings: specify the planned quantity and delivery scope for each item.
- Scoping call and rules of engagement
- Say that testing starts only after the client signs the rules of engagement, with targets, dates and emergency contacts.
- External network test, per public IP address
- List the addresses in an annex rather than on the quotation, and say whether the client owns or rents each one.
- Web application test, per application
- Describe each application by its size, such as the number of user roles, and whether testing is done with logins.
- Findings report with risk ratings
- Say what the report contains: a summary for management and each finding with its risk rating and steps to fix it.
- Retest of fixed findings
- Give the period within which the retest must be ordered, and say it covers only findings from this report.
- Subjects and quantities
- Record sample, asset or site counts, identifiers, test items and accessible areas.
- Method and report
- Specify agreed methods, report format, delivery deadline and whether retesting is included.
- Scope to agree
- Price by target rather than by vague effort, put the written authorisation and the testing window in the notes, and quote the retest separately from the first report.
Before sending
- Does “Scoping call and rules of engagement” say what is included and what quantity the price assumes?
- Would the customer read “External network test, per public IP address” the way you do, including what it leaves out?
- Can you still honour the price of “Web application test, per application” on the last day the quotation is valid?
Show 5 more
- Does “Findings report with risk ratings” say what is included and what quantity the price assumes?
- Would the customer read “Retest of fixed findings” the way you do, including what it leaves out?
- Separate visit, collection and transport costs from analysis and reporting.
- Document inaccessible areas and excluded tests before work starts.
- Check quote validity, the customer approval method and payment milestones.
Worked example: a small online service
The figures are an example, with an example tax rate of 8%. A tester quotes a scoping call, an external test of eight public addresses, tests of two web applications, the findings report and one retest.
| Item | Quantity × unit price | Amount |
|---|---|---|
| Scoping call and rules of engagement | 1 × $400.00 | $400.00 |
| External network test, per public IP address | 8 × $150.00 | $1,200.00 |
| Web application test, per application | 2 × $3,200.00 | $6,400.00 |
| Findings report with risk ratings | 1 × $1,200.00 | $1,200.00 |
| Retest of fixed findings | 1 × $900.00 | $900.00 |
| Subtotal | $10,100.00 | |
| Sales tax (8%) | $808.00 | |
| Total | $10,908.00 | |
The five lines come to $10,100.00; tax at 8% is $808.00; the quotation total is $10,908.00. The address list and the testing dates go into the signed rules of engagement, not into the quotation lines.
Common mistakes on a penetration test quotation
- Starting work on the quotation alone, without signed rules of engagement.
- Pricing by days with no list of targets, so nobody knows what was covered.
- Promising that the systems will be secure.
- Forgetting the hosting provider's rules for testing.
- Leaving the retest out, so fixes are never confirmed.
What the document must show
These details make a quotation easier to approve and to file.
- Your business name, address and registration or tax number
- The customer's name and address
- Issue date and a document number you do not reuse
- Each line item with quantity, unit price and amount
- Tax shown separately from the net amount, and the total payable
- Payment terms: due date, bank details or accepted payment methods
The sales tax depends on where the work is supplied, so set the rate that applies to your customer before sending.
Official rate reference: US government: state and local taxes
Frequently asked questions
The client's servers are run by a hosting provider. Do I need the provider's permission?
Often, yes. Many hosting and cloud providers set rules for testing systems on their platforms. Ask the client to confirm this before the test window and note it in the rules of engagement.
Can the quotation promise that the systems are secure afterwards?
No. A test shows what was found in the agreed scope during the agreed time. Say so in the notes, and keep the wording of the quotation to the work and the report.
What if a critical weakness turns up halfway through?
Agree in advance that critical findings are reported at once to the emergency contact, without waiting for the final report. It costs nothing extra and is worth stating.
Is a retest always worth quoting?
Usually. Clients need evidence that their fixes work, and auditors or customers may ask for it. Quoted now at a known price, it is easy to order later.
How is tax calculated on this template?
The sales tax depends on where the work is supplied, so set the rate that applies to your customer before sending. The editor keeps the net amount, the tax and the total apart, and recalculates all three when you change a quantity, a unit price or the country setting.
Can I use it in another language or currency?
Yes. The document language can be set to any of 33 languages, and changing the country setting updates the currency, the date format and the tax rate.
Read next
Reading for the Penetration test quotation template: How to write a quotation: format, example and checklist and Quote to invoice: how to convert a quote, step by step. The VAT and GST calculator adds tax to your quoted prices.