A penetration test for a San Antonio business typically runs about $3,700 to $18,700 in 2026, which works out to 3 to 15 tester-days at $155.78 an hour, the median federal ceiling rate for penetration testers.
Don’t read that as our price list. It’s a planning range built from public data, and we quote real tests one scope at a time. Uprite runs the tests, and we also do the scoping before and the fix list after. What we protect around here is on our cybersecurity services in San Antonio page. The full process sits on our penetration testing in San Antonio page. This one is about money only, so every number below has a source you can check.
Budget about $1,250 per tester-day at the federal median rate. A narrow external test is roughly 3 days, external plus internal about 8, and adding a web application and a retest pushes it toward 15. The FTC Safeguards Rule and PCI DSS can call for a yearly test, firms under 5,000 consumers are exempt from the FTC clause, and scanning first is the cheapest way to shrink the invoice.
What does a penetration test cost in San Antonio in 2026?
A pen test means paying someone to break in, with your written permission, and tell you how they did it. The bill is simple math. Days of tester time, times what a tester charges per day. Once you know the price, our ranking of the best penetration testing companies in San Antonio shows which local firms to ask for a quote.
We started with the rate. GSA publishes what federal vendors may charge for penetration testers, and on November 5, 2026 we pulled all 441 listings. The median is $155.78 an hour, so an 8-hour day is $1,246. Here are 5 typical scopes at that rate, with the middle half of the market beside each.
| Scope | Planning days | At the median rate | Middle half of rates |
|---|---|---|---|
| External network test, small internet footprint | 3 | About $3,700 | $3,000 to $4,700 |
| Internal network test, one office | 5 | About $6,200 | $5,000 to $7,800 |
| External plus internal | 8 | About $10,000 | $8,100 to $12,500 |
| External, internal, and one web application | 12 | About $15,000 | $12,100 to $18,800 |
| Full scope above plus a retest after fixes | 15 | About $18,700 | $15,100 to $23,500 |
The day counts are our guesses for companies with 20 to 200 people. Your tester’s scope document is what actually sets the price. Still, “it depends” is a lousy thing to hand a CFO, and this gives them a number.
Where does the $155.78 hourly figure come from?
GSA keeps a public database called Contract-Awarded Labor Category, or CALC, with the hourly ceilings vendors have agreed to for federal work. We searched it for penetration testers and found 441 rates across 142 vendors. Half of them land between $125.81 and $195.42. The cheapest is $57.34 and the highest is $320.56.
Experience is the biggest driver. Testers with up to 3 years of experience have a median of $133.22. For 4 to 7 years it’s $162.30, and at 8 years or more it’s $192.97. That’s 45% higher than the junior rate. So find out who will actually be typing the commands. A senior name on page one of the proposal doesn’t mean a senior does the work.
These are ceilings, though. A vendor can’t bill the government more than this, but a private client may pay less, or a small boutique may charge more. We use CALC anyway, because nothing else public has this many tester rates. Check any figure yourself on GSA’s pricing tool.
What about hiring someone instead? BLS counts 1,350 information security analysts in the San Antonio-New Braunfels metro, averaging $60.49 an hour or $125,830 a year, in its May 2025 wage survey. Houston’s average is only 0.8% higher. Benefits add about 43% according to the Employer Costs for Employee Compensation release, which puts one analyst near $179,900. Most of those analysts defend networks all day, too. Nobody in a 50-person company needs a full-time attacker.
What moves a San Antonio pen test quote up or down?
Scope. Almost all of it is scope. Two quotes can differ by $8,000 because one covers 10 systems and the other covers 40. Make sure they price the same job first. These 6 things move the number most.
- How many internet-facing addresses and systems sit in scope, since each adds discovery and testing time.
- Whether the tester starts outside the network, inside it, or both.
- Custom web applications and customer portals, which take far longer to test than a firewall.
- Tester experience, worth about a 45% swing in the federal rate data.
- Whether a retest after you fix the findings is included or billed later.
- Fragile systems that need slow, careful handling, like a lab instrument, a plant controller, or an old line-of-business server.
The last item comes up a lot in San Antonio. Picture a machine shop near Port San Antonio, or a clinic in the Medical Center with an imaging device on the office network. Nobody wants a scan to knock that over at 2 on a Tuesday. Leaving those systems out, or testing them at night, adds days to the bill.
Timing counts too. We avoid month-end close, payroll week, and Fiesta. A test jammed into a bad week gets cut short, and then you’ve paid for half a test.
Do San Antonio businesses have to buy a penetration test?
Some do. Texas doesn’t make private companies test, but a federal rule, a card standard, or a contract might. These are the ones we see most in San Antonio.
| Rule or trigger | What it asks for | Who it reaches |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(d)(2) | An annual penetration test plus vulnerability assessments at least every 6 months, unless you run effective continuous monitoring | Non-bank financial firms such as CPAs, mortgage brokers, auto dealers, and tax preparers |
| Small-firm exception, 16 CFR 314.6 | The testing clause doesn’t apply | Firms holding customer data on fewer than 5,000 consumers |
| PCI DSS v4.0.1, Requirement 11.4 | Internal and external penetration testing at least once every 12 months and after significant changes | Businesses that store, process, or transmit card data |
| HIPAA Security Rule proposal | A test at least every 12 months, proposed in January 2025 and not final as of November 2026 | Covered entities and business associates |
| Cyber insurers and customer contracts | Whatever the application or contract says, often a recent test report | Any firm that signs one |
Read the FTC row closely, because there’s a loophole that’s really a feature. If you have continuous monitoring that actually works, 16 CFR 314.4 lets you skip the yearly test. The 5,000-consumer exemption is in section 314.6. We’re not lawyers, so run this by yours.
On HIPAA, don’t budget for a rule that doesn’t exist yet. The yearly test is only a proposal in the Federal Register. Card rules come from the PCI Security Standards Council, and your bank decides what proof it wants.
And a breach is pricier than any test on that table. Texas gives you 30 days to tell the Attorney General once a breach touches 250 or more Texans, and the office publishes the list. Finding the open door yourself beats reading about it there. Insurers ask about testing too, and our guide to pen testing for cyber insurance in San Antonio covers what they want to see.
How can you spend less on a pen test without buying a worse one?
Clean up first. Imagine paying $1,246 a day for a tester to confirm a missing patch that your own scanner flagged last month. That’s the most expensive scan you’ll ever buy. So the order is inventory, scan, fix, then test what’s left.
Every step before the test costs less than a single tester-day. Our network assessment is free and gives you a device list plus ranked findings. Scanning is included in managed security services in San Antonio from $40 per user per month, and all of our rates are on the pricing page. Critical infrastructure firms can also get CISA’s free Cyber Hygiene scanning of their internet-facing systems.
Here’s something vendors skip. A $1,000 pen test is almost always a scan with a fancier name. Scans are fine, and we sell them, but they answer a different question. Our post on penetration testing vs vulnerability scanning covers which to buy when. No tester name, no hours, no method in the quote? It’s a scan.
Retests are the hidden line item. Nothing counts as fixed until someone checks. Put the retest in the first quote, because a separate visit 3 months later costs more. Our checklist on how to prepare for a penetration test in San Antonio helps keep the scope tight.
How often to pen test in San Antonio comes down to which rule you answer to and how fast your network changes. Yearly is the usual floor. A new office, a cloud move, or a merger is a reason to go sooner.
What should a San Antonio penetration test quote include?
A good quote reads like a work order. Missing any of these 7 items? Ask for it in writing before you sign.
- A target list with addresses, applications, and anything marked off limits
- Testing dates, hours, and an emergency contact on both sides
- The tester’s name and years of experience
- The method, ideally mapped to a public guide such as NIST SP 800-115
- A sample report, so you see the format before you pay for it
- Whether a retest is included, and for how long after delivery
- A signed authorization letter from someone who owns the systems
One more question for any provider, us included. How does the tester stay independent from whoever runs your IT? We do both for some clients, so ask us how we keep the two apart. Grading your own homework is a conflict, and it’s why we quote scanning and testing as separate purchases. The rest of the security budget is in our cybersecurity cost guide for San Antonio, and the Houston version of this guide shows how the same math plays out up the road.
What San Antonio owners ask about pen test pricing
How much does a penetration test cost in San Antonio?
Plan on about $3,700 to $18,700 in 2026, or 3 to 15 tester-days at the $155.78 median federal ceiling rate. A small outside-only test lands low. Inside, outside, a web app, and a retest land high. The written scope sets your actual price.
Why are penetration test quotes so far apart?
Because they rarely cover the same scope or the same tester. Number of systems, inside or outside access, web apps, retests, and experience all change the total. GSA’s data shows $192.97 an hour at the median for 8-plus years, against $133.22 for juniors.
Is a $1,000 penetration test real?
Usually not. $1,000 is less than one tester-day at federal median rates, and a real test needs scoping, testing, and a report. That price almost always means a scan. Ask for the tester’s name, the hours, and a sample report first.
Does the FTC Safeguards Rule require a penetration test every year?
Yes, unless you have effective continuous monitoring, according to 16 CFR 314.4(d)(2). It also wants vulnerability assessments every 6 months. Firms holding data on fewer than 5,000 consumers are exempt under section 314.6. Have your attorney confirm where you fall.
Can we cut the cost by scanning first?
Yes, and nothing works better. If you scan and fix the easy stuff first, the tester’s paid days go to harder problems instead of old patches. Our network assessment is free, and scanning is part of managed security plans from $40 per user per month.
Does Uprite perform the penetration test?
Yes. We run the test ourselves and quote each one by scope. We also write the scope, get you ready, and turn the findings into a fix list we track with you. If we already manage your IT, ask how we keep the testing independent.
How long does it take to schedule a penetration test in San Antonio?
If your inventory is current and you scan regularly, scoping can take a few days. Forgotten servers or a missing admin list mean cleanup first, and that can add a month or more. Then testing runs its planned days, followed by the report and any retest.
Got a request for a test from an insurer, a customer, or an auditor? Send it over. We’ll tell you in writing whether a test makes sense yet, what to fix first, and what a sensible scope looks like. We usually reply within 5 minutes.
Talk to a Security ExpertRather talk it through? Use our contact page and we’ll call you.
