Question 1

How is a pentest scope calculated?

Accepted Answer

A pentest scope is built by counting the assets in scope (web apps, APIs, network ranges, mobile apps, cloud accounts), classifying each by complexity, then estimating tester-days per asset based on depth (recon, exploit, post-exploit), authentication needs, and reporting overhead. This calculator follows that pattern and uses ranges aligned with PTES and OWASP WSTG depth levels.

Question 2

How many days does a typical web application pentest take?

Accepted Answer

A small public web application with a single role typically lands in the 3 to 6 tester-day range. A medium application with authenticated functionality and multiple user roles is usually 6 to 12 tester-days. A large application with complex business logic, multiple integrations, and several roles can run 10 to 20 tester-days or more. The calculator returns a range based on the inputs you select.

Question 3

Does this calculator include report writing time?

Accepted Answer

Yes. Reporting overhead is added as a percentage of testing days. Defaults assume modern report delivery (executive summary, technical detail, remediation guidance) and are adjustable. If you generate reports through a platform with templates and AI assistance, the reporting share of total effort is typically lower than spreadsheet or Word-based delivery.

Question 4

How accurate is a scope estimate from a calculator?

Accepted Answer

A calculator is a starting point, not a quote. It produces a defensible range you can use to validate inbound RFPs, build internal budgets, or compare bids. Final scoping should still happen through a kickoff call where the tester reviews asset complexity, technology stack, prior assessments, and any constraints such as change windows or production-impact rules.

Question 5

What is a sensible retest budget?

Accepted Answer

A common pattern is to allocate 10 to 20 percent of the original engagement effort for retesting findings rated Low and above, typically inside a 60 to 90 calendar-day window after final report delivery. The calculator includes this as a separate line so you can budget retests up front rather than pricing them as change orders later.

Question 6

Should I use day rates or fixed fees?

Accepted Answer

Both work. Day rates are simpler when scope is uncertain and reward thoroughness. Fixed fees are simpler for buyers and reward efficiency, but require accurate scoping up front. Many consultancies use day rates internally for capacity planning and present a fixed fee externally. See the pentest pricing models research for a deeper analysis of each approach and when each one is preferred.

Question 7

Where can I see day-rate ranges by region?

Accepted Answer

Day-rate ranges vary by region, seniority, and certification. Public SecPortal research on pentest pricing models discusses ranges across markets. Use those as comparison points, not as quotes. Buyer-side budgets should also account for project-management overhead, retests, and reporting tooling.

Question 8

Can I share a calculated scope with my team?

Accepted Answer

Yes. The tool keeps state in the URL so you can copy the browser address to share an exact configuration with a buyer, sales engineer, or delivery lead. SecPortal users can also import the scope directly into an engagement record and assign tester-days against tasks once the engagement starts.

Pentest Scoping Calculator
estimate effort, days, and retest budget

1. What is in scope?

2. Engagement parameters

3. Overhead and retest budget

Estimated scope

Tester-days by asset type

Recommended deliverables checklist

Related features

Orchestrate every security engagement from start to finish

Vulnerability management software that tracks every finding

AI-powered reports in seconds, not days

Pentest project management

Penetration testing

Security testing for web applications

Turn this scope into a live engagement

1. What is in scope?

2. Engagement parameters

3. Overhead and retest budget

Estimated scope

Tester-days by asset type

Recommended deliverables checklist

Pentest Scoping Calculatorestimate effort, days, and retest budget

1. What is in scope?

2. Engagement parameters

3. Overhead and retest budget

Estimated scope

Tester-days by asset type

Recommended deliverables checklist

Related features

Orchestrate every security engagement from start to finish

Vulnerability management software that tracks every finding

AI-powered reports in seconds, not days

Pentest project management

Penetration testing

Security testing for web applications

Turn this scope into a live engagement

1. What is in scope?

2. Engagement parameters

3. Overhead and retest budget

Estimated scope

Tester-days by asset type

Recommended deliverables checklist

Pentest Scoping Calculator
estimate effort, days, and retest budget