---
title: "Penetration testing for small businesses: cost, the law and how to choose a provider"
description: "Vulnerability scan, pentest, red team or bug bounty? What drives the cost of a penetration test, what the law says, how to read the report and what to ask."
url: https://krakenshield.eu/knowledge/blog/penetration-test-cost-choosing-provider/
lang: en
updated: 2026-11-10
publisher: KrakenShield (KRAKEN HOLDING SAS)
overview: https://krakenshield.eu/llms.txt
---
# Penetration testing for small businesses: cost, the law and how to choose a provider
> Vulnerability scan, pentest, red team or bug bounty? What drives the cost of a penetration test, what the law says, how to read the report and what to ask.

Guide Published 10 November 2026

A customer wants your latest penetration test report, or you simply want to know whether your website would hold up against a real attacker. Here is how to buy the right test, frame it legally, understand what drives the price and get value from the report.

By **Nestor** 8 min read

A major customer sends over its security questionnaire: “Date of your last penetration test? Please attach the executive summary.” You start looking for a provider and find offers that are impossible to compare, from an automated scan delivered in a day to an engagement lasting several weeks. This guide helps you buy the right test, frame it without legal risk and get something useful out of it.

A [penetration test](https://krakenshield.eu/knowledge/glossary/penetration-testing/), or pentest, means asking specialists to play the attacker, with your written consent, to find out what a real intruder could reach. The stakes are concrete: exploiting a vulnerability is still the most common way in.

32%

*of the intrusions Mandiant investigated began with the exploitation of a vulnerability, the top initial vector for the sixth year running*

Source: Mandiant, M-Trends 2026

## Scan, pentest, red team, bug bounty: don’t buy the wrong thing

These four approaches are often confused, sometimes deliberately in sales pitches. They answer different questions.

|  | Vulnerability scan | Penetration test | Red team | Bug bounty |
| --- | --- | --- | --- | --- |
| **Question** | Which known flaws are visible? | How far would an attacker get within this scope? | Would we spot a realistic attack, and respond well? | What do diverse researchers find over time? |
| **Who runs it** | A tool | Experts with tooling | A discreet offensive team | A community paid per valid finding |
| **What you get** | A list, with false positives | Proven, prioritised attack scenarios | A measure of your detection and response | Reports as they come in |
| **For a small business** | Essential, continuously | Once a year and after every major change | Rarely worthwhile before you have a monitoring team | Useful if you publish software or an online service |

A [red team](https://krakenshield.eu/knowledge/glossary/red-team/) pursues a specific goal (reaching the payment system, say) without warning your staff, to test detection as much as prevention. A [bug bounty](https://krakenshield.eu/knowledge/glossary/bug-bounty/) opens a scope to independent researchers who are paid only for valid findings. For most small businesses, the right pairing is a regular scan plus an annual penetration test.

> **Nestor Former hacker turned defender:** A scanner knocks on every door and notes which ones creak. I climb in through the toilet window everyone forgot about, then see how far the corridor goes.

## Black, grey or white box: where to start?

Before the engagement, you decide how much the testers know at the outset: [black, grey or white box](https://krakenshield.eu/knowledge/glossary/black-grey-white-box/).

- **Black box** : no information, like an outside attacker. Realistic, but part of the budget goes on discovery.
- **Grey box** : a standard user account and a few architecture details. For a small business this is often the best value: it also covers what a malicious customer or an employee with a stolen account could do.
- **White box** : documentation, configuration, sometimes source code. Less realistic, but coverage is at its widest.

## The law in France: written authorisation first

> **Article 323-1 of the French Criminal Code**
> Article 323-1 of the French Criminal Code
> 
> Fraudulently accessing or remaining in a computer system carries 3 years in prison and a €100,000 fine; 5 years and €150,000 if data is deleted or altered or the system is disrupted; 7 years and €300,000 for a personal data system run by the State. Article 323-3-1 also punishes possessing attack tools without a legitimate reason, research and IT security being cited as legitimate reasons.

The only thing separating a penetration tester from a criminal is authorisation. It must be in writing, signed by someone with genuine authority over the systems (the managing director or a named delegate), and come with two documents:

- **the contract** : responsibilities, confidentiality, insurance and what happens to data collected during the test;
- **the [rules of engagement](https://krakenshield.eu/knowledge/glossary/rules-of-engagement/)** : exact scope (domains, addresses, applications), dates and hours, the testers’ source addresses, prohibited actions (denial of service, deleting data, social engineering unless agreed) and emergency contacts on both sides.

Watch out for third parties. If your website sits with a host or your software with a SaaS vendor, you can only authorise what you own or what your contract lets you have tested. Major cloud providers publish their rules: AWS, for instance, allows tests on a list of services without prior approval but bans any denial of service. Read those rules and attach them to the contract. Our chapter on [ethical hacking and the law](https://krakenshield.eu/knowledge/a-to-z/17-ethical-hacking-and-the-law/) covers the full legal picture.

> **Nestor Former hacker turned defender:** I learnt the Criminal Code from the inside, so here is the short version: the same request earns an invoice with a signed authorisation, and a criminal record without one. I don’t touch a keyboard until I have the paperwork.

## A typical engagement, step by step

1. **Scoping.** Objectives, scope, level of information, timetable, contacts. Name an internal lead and check your backups.
2. **Reconnaissance.** The testers map what is visible: subdomains, exposed services, technologies, public information about the company.
3. **Testing.** They check which weaknesses are real and exploit them just enough to prove the impact, without breaking anything or taking real data. A critical flaw should be reported to you straight away, not saved for the report.
4. **Report.** An executive summary, then the detail of each vulnerability with evidence and recommendations.
5. **Debrief.** A meeting with management and technical staff to explain, prioritise and answer questions.
6. **Retest.** Once you have fixed things, the testers check the holes are really closed. Without this step you don’t know whether the fix works.

The testing itself takes from a few days for a single website or application to a few weeks for a full internal and application scope. Allow for scoping before and the retest after.

## How much does a penetration test cost?

There is no official price list: ANSSI, the French national cybersecurity agency, qualifies providers but publishes no rates, and the ranges you find online come from providers themselves and vary widely. Keep one formula in mind: **price = number of person-days × day rate** . The number of days is what moves most.

| Factor | What pushes the number of days up |
| --- | --- |
| Scope | Number of exposed addresses, applications, APIs, sites |
| Application roles | Each profile (customer, manager, administrator) is tested separately |
| Level of information | Black box needs more discovery than grey box |
| Type of test | External, internal, web application, cloud, social engineering |
| Constraints | Night-time testing, fragile production systems, urgency |
| Qualification | A PASSI provider commits to method and follow-up requirements |
| Deliverables | Bilingual report, on-site debrief, retest included or not |

> **A “pentest” delivered in 24 hours?**
> A “pentest” delivered in 24 hours?
> 
> It is almost always an automated scan with a new label. Insist on a quote broken down into days per activity, the methods followed, an anonymised sample report and the retest.

## The PASSI qualification: what it is and when to require it

PASSI stands for “prestataire d’audit de la sécurité des systèmes d’information”, France’s qualification for information security audit providers, awarded by ANSSI after assessment. The current baseline (version 2.2, published on 29 November 2024) covers five activities: architecture, configuration and source code audits, penetration testing, and organisational and physical audits. It has two levels, substantial and high.

**When is it mandatory?** For inspections of the information systems of operators of vital importance (OIV, France’s critical infrastructure operators) ordered by the Prime Minister: under article L1332-6-3 of the French Defence Code, these are carried out by ANSSI, by designated State services or by qualified providers. It is also frequently required in public tenders or by contract. In finance, the EU’s DORA regulation separately requires entities designated by their authority to run threat-led penetration tests at least every three years, under its own rules.

For a small business with no such constraint, the qualification is not compulsory, but it guarantees a method, a contract and data handling you should expect from any provider. ANSSI publishes the list of qualified providers on cyber.gouv.fr. To be clear: KrakenShield is not PASSI-qualified.

## Reading the report: CVSS and prioritisation

Start with the executive summary: in one page, it should say what an attacker could reach and name the three or four priority workstreams. Each vulnerability is then scored, usually with [CVSS](https://krakenshield.eu/knowledge/glossary/cvss/) (version 4.0, published on 1 November 2023): low from 0.1 to 3.9, medium from 4.0 to 6.9, high from 7.0 to 8.9, critical from 9.0 to 10.

CVSS measures technical severity, not your risk. To decide the order of fixes, ask three questions:

- **Is it exposed?** A flaw reachable from the internet comes before an internal one.
- **Is it being exploited?** The [EPSS](https://krakenshield.eu/knowledge/glossary/epss/) score estimates the probability of exploitation within 30 days, and the [KEV](https://krakenshield.eu/knowledge/glossary/kev/) catalogue from the US agency CISA lists flaws already exploited in the wild.
- **What sits behind it?** A flaw on payroll or production weighs more than one on a demo server.

> **Belinda PhD in cryptography:** A report is not a school report to file away in a drawer. I always ask for a tracking sheet: each finding, an owner, a date, and a column marked “confirmed at retest”.

## Questions to ask a provider

- Who will do the testing? Names, experience with a scope like yours, hands-on certifications.
- Are you PASSI-qualified, and for which activities? (Check ANSSI’s list.)
- Which method do you follow, and can you show an anonymised sample report?
- Does the quote break down days per activity, the debrief and the retest?
- What happens if you find a critical flaw mid-engagement?
- Which actions are excluded to protect production?
- Where is collected data stored, who can access it, and when is it destroyed?
- Do you hold professional liability insurance that covers testing?
- Are you independent from the company that installed or maintains our systems?
- Which source addresses will you test from, so we can recognise you in our logs?

## Between two pentests

A penetration test is a snapshot on a given date. In between, new flaws are published every week and your systems change. KrakenShield’s non-destructive penetration test, launched from the console on a domain whose ownership you have proved and under your authorisation, lets you replay reconnaissance and vulnerability discovery after every fix ([see what it covers](https://krakenshield.eu/#capacites)). It complements a manual pentest; it does not replace one on a critical scope.

Also prepare for the day an attacker gets through anyway: our article [Ransomware attack: what to do](https://krakenshield.eu/knowledge/blog/ransomware-attack-what-to-do/) covers the first hours. For more on methods, standards and testing frequency, read the chapter [Penetration testing from A to Z](https://krakenshield.eu/knowledge/a-to-z/13-penetration-testing/).

## Key takeaways

1. A scan lists known flaws; a penetration test proves, by hand, how far an attacker would get. Do not pay for the second and receive the first.
2. Without written permission from someone with authority over the systems, a test is unauthorised access, an offence under article 323-1 of the French Criminal Code.
3. The price depends on the number of person-days, so on scope and how much information you share: compare detailed quotes, not flat packages.
4. France’s PASSI qualification is mandatory in a few settings (inspections of operators of vital importance) and a mark of rigour elsewhere.
5. CVSS gives technical severity; priority depends on exposure, real-world exploitation and business value. Always plan a retest.

## Frequently asked questions

**How much does a penetration test cost for a small business?**

There is no official price list: a penetration test is billed in expert person-days. The price depends on scope (number of addresses, applications and user roles), how much information you provide, the depth expected and the provider’s qualifications. Ask several providers for quotes broken down into days per activity, with the retest included.

**What is the difference between a vulnerability scan and a penetration test?**

A scan is automated: it spots known weaknesses and produces a list, false positives included. A penetration test is run by experts who verify each flaw, chain them together and show what an attacker could actually reach. Both require permission from whoever owns the systems.

**Is penetration testing mandatory?**

Not for every business. It is required in some settings: inspections imposed on French operators of vital importance, and threat-led penetration tests that the EU’s DORA regulation requires of designated financial entities. Elsewhere, customers, insurers and tenders are usually the ones asking for it.

**How long does a penetration test take?**

The testing itself takes from a few days for a single website or application to a few weeks for a full internal and application scope. Add scoping beforehand, then report writing, the debrief and, once you have fixed the findings, the retest.

**Do I need a PASSI-qualified provider?**

PASSI is the French state qualification for security audit providers. It is mandatory for inspections of vital information systems and often required by public-sector or large customers. For a small business with no such constraint, it signals method and confidentiality rather than being an obligation. ANSSI publishes the list of qualified providers.

## Sources

- [Légifrance, French Criminal Code, articles 323-1 et seq. (offences against automated data processing systems, in French)](https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006070719/LEGISCTA000006149839/)
- [Légifrance, French Defence Code, article L1332-6-3 (inspections of vital operators’ information systems, in French)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000028342870)
- [ANSSI, qualification requirement baselines (PASSI v2.2, in French and English)](https://cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/qualification-de-produit-et-services/referentiels-qualification/)
- [ANSSI, update of the PASSI (version 2.2) and PRIS (version 3.0) baselines, 29 November 2024 (in French)](https://cyber.gouv.fr/actualites/lanssi-met-jour-les-referentiels-passi-version-22-et-pris-version-30)
- [Regulation (EU) 2022/2554 (DORA), article 26 on threat-led penetration testing](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554)
- [FIRST, CVSS v4.0 Specification Document](https://www.first.org/cvss/v4.0/specification-document)
- [FIRST, Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/)
- [CISA, Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Mandiant (Google Cloud), M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026)
- [AWS, Penetration Testing policy (permitted services and prohibited activities)](https://aws.amazon.com/security/penetration-testing/)

[Go further**Penetration testing from A to Z** Cyber A to Z, chapter 13](https://krakenshield.eu/knowledge/a-to-z/13-penetration-testing/) [All articles](https://krakenshield.eu/knowledge/blog/)

## More from the blog

[Guide **Qualys SSL Labs or KrakenShield: getting an A+ and keeping it**](https://krakenshield.eu/knowledge/blog/ssl-labs-vs-krakenshield-ssl-test/) [News **The biggest bank hacks of the last 30 years: from Citibank to Binance and Crédit Mutuel Arkéa**](https://krakenshield.eu/knowledge/blog/biggest-bank-hacks-30-years/) [Guide **Free post-quantum scan: will your website withstand quantum computers?**](https://krakenshield.eu/knowledge/blog/free-post-quantum-scan-website/)