ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Validate insights →Infrastructure penetration testing cost and scoping
Build comparable infrastructure proposals around internal and external boundaries, identities, constraints and useful deliverables.
Build comparable infrastructure proposals around internal and external boundaries, identities, constraints and useful deliverables.
Need an acronym translated?Open the cyber glossary →Explain the business service and assessment boundary
An infrastructure quotation should begin with the service and assurance question. List the external addresses and network services, internal segments, sites, remote-access routes and relevant cloud connections. Distinguish a perimeter assessment from work starting with an internal foothold. A count of devices without their roles, trust relationships and access assumptions can hide substantial differences between proposals.
Separate internal and external access assumptions
External work examines the agreed internet-facing boundary. Internal work may require a representative user account, an on-site connection or another defined starting position. State whether directory services, privileged administration, network segmentation and wireless environments are included. A single combined label should not obscure which areas are being tested or which require a separate component.
Show what changes the effort
The number of targets matters, but so do service diversity, multiple sites, complex identities, restrictive operating windows, fragile systems and the depth of investigation required. Provide a current inventory and network overview. Identify repeated standard builds and genuinely different systems. Ask the provider to explain the assumptions behind the effort rather than comparing only the headline day count.
Prepare access and safety arrangements
Agree contact routes, permitted techniques, exclusions, rate limits, escalation and stop conditions. Explicit written authorisation is required before active testing. Coordinate with hosting, managed-service and network owners where their systems could be affected. Business-critical or operational technology needs a specific safety discussion; its presence in an address range is not enough to authorise unrestricted testing.
Compare the complete quotation
Check whether the proposal includes preparation, test execution, reporting, a technical debrief, remediation guidance and retesting. Record travel, out-of-hours work, additional environments and any separate investigation. Use the current published pricing journey for indicative costs, then obtain a scope-specific proposal.
Make the outputs useful beyond procurement
Specify the scope record, evidence expectations, prioritised findings, named remediation actions and retest arrangements. The service owner should understand what the assessment establishes and what remains outside it. For multi-site organisations, agree whether on-site access, travel, local contacts and access windows affect delivery. A consistent scope helps teams compare proposals across locations.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Modern penetration testing should create decisions, not just findings” →
