Penetration Testing Cost in Canada: Real Price Ranges and What Drives Them

A customer's security questionnaire asks for "your most recent penetration test." Or your payment processor wants one before renewal. Now someone has to put a number in next year's budget, and the penetration testing cost figures you find online are in US dollars, British pounds, or vague phrases like "a few thousand dollars."

Short answer: in 2026, most conventional penetration tests in Canada cost about $5K to $45K (CAD), based on published Canadian rate guides. A narrowly scoped external network test or a small web application sits near the bottom, at $5K to $20K. Combined internal and external testing runs $15K to $50K. Red team engagements start around $30K and can pass $150K. The price is mostly tester-days multiplied by a day rate, so scope drives everything.

This guide gives you the Canadian-dollar ranges by test type, shows how a quote is actually built, converts the foreign figures that fill most price guides, and sets out which Canadian rules require you to test at all. All figures are Canadian dollars unless marked US$ or £. They're market figures from published guides, not an SMEnode quote.

Not sure what you'd even need to test? Our free IT and security assessment takes a couple of minutes and shows where your gaps are before you spend anything on a test.

How much does penetration testing cost in Canada in 2026?

Here's what Canadian rate guides published or updated in 2026 list for each type of test. The "typical" column covers small and standard scopes. The last column is where complex scopes land: many user roles, several sites, large Active Directory forests, or multiple cloud accounts.

Sources: two Canadian penetration testing rate guides, updated 2026-08-27 and published 2026-06-05. One calls its figures "illustrative estimates for budgeting." The other labels its bands as its own benchmark. Treat both as a starting point, not a quote.

So what's the average cost of penetration testing in Canada? There isn't a useful single average. A $6K external test and a $120K red team both count as "a pen test," so the mean tells you nothing. One of the Canadian guides puts most conventional engagements at about $5K to $45K, and that's the honest middle of the market.

Why do so many price guides quote US dollars or pounds?

Because most of the pages that come up for this question are written by US and UK firms. The AI summary at the top of Google.ca builds its table from US guides. The top organic result quotes UK day rates in pounds.

That matters more than it looks. On 2026-10-21 the Bank of Canada daily rate was 1.4057 CAD per US dollar and 1.8826 per pound. So:

• A "US$10K" pen test is about $14.1K in Canadian dollars.
• A UK day rate of "£600 to over £3,000" is about $1.1K to $5.6K a day.
• A US$96-a-month scanning tool is about $135 a month.

If a budget was built from a US guide without converting, it's about 29% short, and you'd need roughly 40% more to cover the same test. That's more common than you'd think.

What drives the cost of penetration testing?

Strip a quote down and it's a simple sum: tester-days × day rate, plus reporting, plus the retest. Everything that changes the price changes one of those three.

Here's what moves the number of tester-days:

• Asset count. Public IP addresses, domains, subnets, sites, cloud accounts. More targets, more days.
• Depth of access. Black box (no information), grey box (a normal user login) or white box (credentials, documentation, sometimes source code). One 2026 Toronto web application guide says white-box access adds 3 to 5 days.
• Authenticated roles. A web app with one login is one test. A SaaS platform with admin, manager, customer and API roles is closer to four.
• Active Directory size. Internal tests on a large, old AD forest take longer because there are more paths to domain admin.
• Manual versus automated work. A scanner run takes hours. A tester chaining findings together takes days. That's the difference you're paying for.
• Compliance reporting. PCI DSS needs a documented methodology and evidence your assessor will accept. Formal reports take time to write.
• The retest. PCI DSS v4.0.1 requirement 11.4.4 expects exploitable findings to be corrected and the fix retested. Some firms include it. Others bill it separately.
• Timing. Testing outside business hours, rush delivery and on-site work (with travel) all add cost.

What's the penetration testing cost per hour or per day?

Firms usually quote per day or per project, rarely per hour. Published day rates are wide:

Why so much higher than a salary? Start with the wage floor. Job Bank lists Canadian cybersecurity specialists (NOC 21220) at a median of $49.52 an hour and a high of $72.12. That's about $371 a day at the median and $541 at the top, for a 7.5-hour day, before benefits (96.2% of people in this occupation get at least one).

A consulting day rate sits well above that, and here's the thing: it has to. It covers the scoping calls, the report writing and QA review, tool licences, professional liability insurance, and the weeks a senior tester spends between engagements. So when a quote's day rate looks close to a salary, ask what's missing.

How much should a penetration test cost for a business like yours?

Three composite examples. They're not clients. The tester-day counts are illustrative, based on published 2026 scoping figures, and your own scope will differ.

Picture a 40-person accounting firm in Mississauga. It has a dozen public IP addresses, a client portal bought off the shelf and Microsoft 365. Its cyber insurer and two larger clients want an external test. That's a few tester-days plus a report, so it sits at the low end of the external range, roughly $5K to $15K.

Picture a 150-person software company in Ottawa selling to a bank. The bank wants a test of the web app and its documented REST API. A 2026 Toronto guide puts a web app plus documented API at 8 to 12 testing days. At $1.4K to $2.2K a day, that's about $11K to $27K before the retest, inside the published web and API bands.

Picture a 400-person retailer in Montreal that takes card payments in-store and online. PCI DSS needs internal and external testing, segmentation testing and a retest of anything exploitable. That's combined testing, so $15K to $50K is a realistic planning range, more if there are many stores on separate networks.

If one of these looks like you, our penetration testing services page shows how we scope a test, what's in the report and how the retest works.

What do network, web application, cloud and PCI penetration tests cost?

External and internal network penetration testing cost

External penetration testing cost is usually the lowest line on any quote: $5K to $20K in one Canadian guide, with complex scopes going past $35K in another. The tester attacks what the internet can see, such as your firewall, VPN, email gateway and exposed services.

Internal network penetration testing cost is higher, at $8K to $35K typical, because the tester starts inside (as a compromised laptop would) and works toward your crown jewels. Much of that time usually goes into Active Directory, flat networks and unpatched older servers. If you've never segmented your network, expect findings here, and expect them to matter.

Web application penetration testing cost

Web application penetration testing cost depends on roles and features, not page count. One 2026 Toronto guide breaks the days down like this:

Those days line up with the Canadian bands above. Use them to sanity-check a quote: if a firm prices a two-role SaaS app at two days, ask what they're skipping.

AWS and Azure penetration testing cost

There's no fee from AWS or Microsoft to test your own cloud. AWS lets customers test their own resources without prior approval for a published list of services, including EC2, RDS, Aurora, CloudFront, Lambda, ECS and Fargate. Anything involving command and control needs approval, and denial-of-service testing is prohibited. Microsoft's rules of engagement allow testing inside your own tenant, ban denial-of-service attacks, and set out no notification step.

So AWS penetration testing cost comes down to scope: how many accounts, how tangled your IAM roles are and how much is exposed. Published Canadian bands for cloud testing run $10K to $40K, with complex multi-account estates at $65K and up. If you want the configuration review without the attack simulation, a cloud security assessment is often the cheaper first step.

PCI penetration testing cost

PCI penetration testing cost is higher than the same test done for its own sake, because the standard sets the scope. Under PCI DSS v4.0.1 (published by the PCI Security Standards Council):

• 11.4.2 and 11.4.3: internal and external testing at least once every 12 months and after any significant change.
• 11.4.4: exploitable vulnerabilities are corrected and the fix is retested.
• 11.4.5: if you use segmentation to shrink scope, test it at least every 12 months.
• 11.4.6: service providers test segmentation every six months.

That's two tests, a segmentation check and a retest, plus a report your assessor will accept. Budget from the combined range, $15K to $50K, rather than the single-test bands.

Is automated penetration testing a low-cost substitute?

Partly. Automated penetration testing tools are cheap: one widely used platform starts at US$96 a month for 16 assets (about $135). One Canadian guide treats any "pen test" quoted at $2K to $3K as likely to be an automated scan with a report template on top.

Scanners are good at known vulnerabilities, missing patches and misconfigurations, and you should run them between tests. They don't chain three medium findings into one critical breach path, test business logic, or abuse a role that can see another customer's data. That's still a human's job, and PCI DSS treats a vulnerability scan and a penetration test as separate requirements.

So the sensible split is continuous scanning, often run as part of vulnerability management, plus a manual test once a year and after big changes. Is pentesting being replaced by AI? The tools are getting faster at the scanning half. The judgement half isn't going anywhere yet.

How often should a penetration test be done in Canada?

At least once a year, and after any significant change, for most organisations that need one at all. But only some Canadian rules actually require testing, and they don't all say the same thing:

Two things fall out of that table. First, if you're a small business outside payments and finance, no Canadian rule forces a test. The pressure usually comes from customers, insurers and contracts. Second, OSFI doesn't hand banks a fixed annual schedule. It makes them set and justify their own, which is why banks push testing requirements down to their suppliers.

Whatever the rule says, test again after anything that changes your attack surface: a new app release, a cloud migration, a merger, or a firewall replacement. If you don't know where your risk sits yet, a threat and risk assessment should come before the first test. Our guide to a cybersecurity risk assessment walks through how that works.

How long does a penetration test usually take?

Hands-on testing for most scoped tests takes about one to three weeks of tester time (4 to 15 testing days in one 2026 Toronto guide). The whole engagement, from scoping call to final report, runs three to five weeks in one published 2025 guide.

Rough guide:

• Small external test: a few days of testing.
• Web app with API: 8 to 12 testing days, per one 2026 Toronto guide.
• Web, API and mobile together: 11 to 15 testing days.
• Combined internal and external: longer again, and one 2025 guide says firms typically put two or three people on an engagement.
• OSFI I-CRT red team: the framework sets out four phases, from initiation (6 to 8 weeks) to closure (4 to 6 weeks), so about 24 to 36 weeks end to end.

Add lead time. Good firms are often booked weeks out, and rush jobs cost more. If your audit deadline is in six weeks, call this week.

Who performs penetration testing, and is it legal?

Penetration testers work for specialist security firms, consulting firms and managed security providers, or on internal red teams at large banks and tech companies. Buyers usually look for hands-on certifications such as OffSec's OSCP, GIAC's GPEN or CREST's tester exams, plus a sample report that shows the work.

Is pentesting illegal? Not with permission. Under the Criminal Code, section 342.1, unauthorised use of a computer is an offence when it's done "fraudulently and without colour of right," with a maximum of 10 years. Written authorisation from the system owner, with a defined scope and testing window, is what separates a test from an attack. That's why a reputable tester insists on signed paperwork before touching anything. (This isn't legal advice. Get your own counsel to review the authorisation letter if you're unsure.)

Independence matters too. Testing your own work is weak evidence, which is why many organisations bring in a third party even when they have in-house security staff. A managed security service provider that runs your monitoring can usually scope a test, but ask whether the testers are separate from the people who built your controls.

What is penetration testing, and what's another name for it?

A penetration test is a controlled, authorised attack on your systems to find out what a real attacker could do. NIST defines it as a test in which assessors, "typically working under specific constraints, attempt to circumvent or defeat the security features of a system."

Other names you'll see:

• Pen test or pentest, the short forms.
• Ethical hacking or white-hat testing, which describe the same activity from the tester's side.
• Security testing or offensive security assessment, used loosely in contracts.

Two terms aren't the same thing. A vulnerability scan is automated and finds known weaknesses. A red team engagement is longer and stealthier, testing whether your people and tools detect an attack, not just whether holes exist.

Is a penetration test worth the cost?

Put the test next to the alternative. IBM's 2026 Cost of a Data Breach report puts the average Canadian breach at a record CA$7.11M, up from $6.98M in 2025. Supply-chain compromise was the largest cost driver, adding $368K.

That's a study-wide average, not your number. Costs vary widely with company size and sector. But a $15K test that finds the path from a phished laptop to your file server is cheap next to a week of downtime, forensic work and customer notification. And if a customer contract requires a test, the question isn't really whether. It's how to buy the right one.

Where a test isn't worth it: if you haven't patched, haven't turned on MFA and don't know what's exposed, a tester will spend paid days telling you that. Fix the basics first, scan, then test.

How do you get an accurate penetration testing quote?

Send the firm the facts that drive tester-days, and you'll get a quote you can compare. Here's what to have ready:

1. External scope: number of public IPs, domains and internet-facing services.
2. Applications: each web app, API and mobile app, with the number of user roles.
3. Internal scope: sites, subnets, rough endpoint count and Active Directory domains.
4. Cloud: which providers, how many accounts or subscriptions.
5. Driver: PCI DSS, OSFI, a customer contract, an insurer, or your own risk review.
6. Constraints: testing windows, production systems that can't be touched, and whether you need a French-language report.
7. Deliverables: full report, executive summary, retest, and whether you need a short attestation letter to share with customers.

Red flags in a quote:

• A firm price before anyone asked about your scope.
• A "pen test" at $2K to $3K for a real business. One Canadian guide flags that range as a likely automated scan.
• No named methodology (for example NIST SP 800-115 or the OWASP testing guide).
• The retest isn't mentioned. Ask whether it's included before you sign.
• No sample report. If they won't show you one, assume it's a scanner export.

Want a rough pentest cost calculator? Use the sum: (testing days + reporting days + retest days) × day rate. Take the testing days from the ranges in this guide, ask each firm for its day rate and reporting days, and compare like with like. Low cost penetration testing that skips the retest or the manual work isn't cheaper. It just moves the cost to later.

Quick answers

Is there government funding for a penetration test in Canada?

We couldn't find a federal grant that pays for a penetration test as of 2026-10-22. CyberSecure Canada is a certification, not a subsidy. If you're already working with an NRC IRAP advisor on a wider technology project, ask whether security testing can sit inside that project, and ask about current intake before you plan around it.

Does a penetration test cost more in Toronto than in the rest of Canada?

The Canadian rate guides we used price penetration testing Canada-wide rather than by city, and most testing is done remotely, so location matters less than scope. On-site internal testing adds travel. If you're in the GTA, Ottawa or Montreal, see our local pages for cybersecurity in Toronto, Ottawa and Montreal.

Is the retest included in the cost of penetration testing services?

It depends on the firm. Some include one retest. Others bill it as a separate engagement. PCI DSS 11.4.4 expects exploitable findings to be fixed and retested, so if requirement 11.4 applies to you, the retest isn't optional. Get it in writing.

Bottom line

Budget $5K to $45K for most penetration tests in Canada in 2026, more for combined, cloud-heavy or PCI scopes, and treat any US or UK figure as needing conversion first. Then look past the total: the tester-days, the day rate, and whether the retest is included tell you more about a quote than the bottom line does.

If you'd like a senior engineer to look at your scope before you ask for quotes, contact SMEnode. We'll tell you which test you need, what can wait, and when a scan will do.