What does a vulnerability scan cost, and what does a pentest cost?
Published on October 28, 2026
A vulnerability scan costs anything from nothing to a few hundred euros per month, a pentest usually €3,000 to €15,000 each time. Those amounts say little as long as you do not know what you get for them, and many providers publish no price. This overview puts the public prices side by side, by type of service, as they appeared on the providers' sites on 28 October 2026. Exposentry sells scans itself; its own prices are listed separately further down and are not included in the ranges.
In short
- An external scan you operate yourself costs €29 to €399 per month with Dutch providers, often with a free version. If you have specialists prioritise the findings, that costs €295 to €750 per month with the providers in this overview.
- A pentest is priced per test day, usually €1,000 to €2,000 per day. Testing one web application typically costs €3,000 to €15,000.
- The price depends on what is measured, how often, how much human work is involved and what you get back as evidence.
Why prices vary so widely
Four things determine the price. The first is what is measured. An external scan looks at what your organisation exposes to the internet: websites, mail servers, entry points to your systems that can be reached from the internet (open ports) and your website's security certificate. An internal scan looks inside your network and needs a device or software at your premises to do so.
The second is how often. A one-time measurement gives the picture of a single day. A continuous scan keeps that picture up to date, and for that you pay per month.
The third is human work. Software is cheap to repeat, a specialist costs money by the hour. As soon as someone checks, prioritises or discusses findings with you, the price goes up. With any scanner without human review, someone on your side has to assess the alerts, and that takes hours too.
The fourth is what you get back: a list in a dashboard, a PDF, or a dated report that a customer or auditor can later check has not been altered. A completed questionnaire records what you declare; a measurement report records what the measurement found on your external attack surface that day. That is the difference between paper and measurement.
What does a vulnerability scan cost?
Every range below is based on prices checked on the providers' sites on 28 October 2026. Excl. VAT is stated only where the source says so.
| Type of service | What you get | Price as published | Based on |
|---|---|---|---|
| Free tests | A measurement of your website, mail or domain, one-off or in a limited free version | €0 | internet.nl, the NCSC tools, the free version of four scanners and the supply-chain scan (ketenscan) of 1338.nl |
| Free questionnaires | A self-assessment: you answer questions, nothing is measured | €0 | Lupasafe, Samen Digitaal Veilig |
| One-time scan with report | One measurement with a report and recommendations | roughly €300 to €2,000 | 3 sources |
| External scan, self-operated | Continuous scan of your domains, results in a dashboard or PDF | €29 to €399 per month with Dutch providers; internationally up to €434; large packages from €499 | 2 Dutch and 2 foreign providers |
| Internal network scan with device | Scan of the systems inside your network, with a small box or software on site | €89 per month (one scan per year) to €199 (every quarter); with a monthly internal and external scan from €350 | 2 providers |
| Managed continuous scan | Scan plus specialists who prioritise findings and produce a monthly report | €195 per month for the scan alone; with monthly report and prioritisation by ethical hackers €295 to €495, for one domain (1 provider); packages for up to five users with compliance support from €350, with awareness training €750 (1 provider) | 2 providers |
| NIS2 package per user | Platform with self-assessment, scans and reporting, paid per employee | €6.80 to €9.20 per user per month excl. VAT (up to 100 users) | 1 provider |
| Certificate route | Certificate registration for "NIS2 Supply Chain" and training to prepare for the audit; a scan is not mentioned | €1,450 to €9,800 per year, depending on your size; members of a partner association pay half | 1 provider |
Most scanners you operate yourself have a free version, limited to one domain or a few systems. Whether you pay per domain, per system, per IP address or per user can make a considerable difference if you have several domains. Also ask whether subdomains the scanner finds itself, such as shop.yourcompany.nl, cost extra.
What does a pentest cost? Price per test and per day
In a pentest a specialist, with your written permission, actively tries to break into your systems. You agree the scope in advance: which systems are tested and how deeply. A pentest lasts an agreed number of days (the Dutch NCSC calls it an activity with a fixed duration, in Dutch), and providers charge per test day.
| Type of pentest | Usual price | Based on |
|---|---|---|
| Day rate | €1,000 to €2,000 per day (€125 to €250 per hour); outliers from €849 to €2,500 per day | 4 providers and a market survey |
| Small one-day test | around €1,000 | KVK |
| One web application | €3,000 to €15,000, usually 3 to 10 test days; outliers up to €20,000 and more | 6 sources |
| Your external attack surface (external infrastructure) | €2,500 to €8,000 | 1 provider and 1 secondary source |
| Your internal network | €4,500 to €15,000 | 3 providers |
| Red team, an attack over a longer period and along several routes | €20,000 to €50,000 and more | 1 source |
The Dutch Chamber of Commerce (KVK, in Dutch) mentions around €1,000 and one day of work for a small pentest. Be careful with offers below that. A manual pentest for a few hundred euros hardly exists. The Dutch Centre for Crime Prevention and Safety (Centrum voor Criminaliteitspreventie en Veiligheid, CCV), which manages the Pentesting quality mark (keurmerk Pentesten), calls a test that is largely automated a vulnerability scan (in Dutch). For that kind of amount, what you get in practice is an automated scan.
What determines the price of a pentest
The scope is the main driver of the price. The NCSC warns that a scope that is too broad or vague makes a test too expensive or too shallow, and advises not comparing quotes on price alone (in Dutch). For a web application, the number of user roles counts, such as customer, employee and administrator: every role with its own rights has to be tested separately.
The test method also counts. In a black-box test the tester gets nothing in advance and has to find out everything alone, like an outside attacker. In a grey-box test the tester gets a user account, in a white-box test also documentation or source code. According to the NCSC, a black-box test costs more time and money (in Dutch).
Providers also differ in qualifications, such as the CCV quality mark for the provider or an internationally recognised pentest certification (OSCP) for the tester, in whether a retest after remediation is included in the price, and in the surcharge if it has to be done quickly. Also ask for an anonymised sample report, because the report is what you keep afterwards.
How long it takes, and how often
Some providers start within two weeks. The test itself usually takes 3 to 10 working days, and the report follows within a few working days. One market survey puts it at two to four weeks (in Dutch) from intake to report. The NCSC gives no fixed interval for repeating a test: test regularly, when you introduce new systems and after changes to your IT environment.
A pentest can also be taken as a subscription: the provider then tests continuously or at fixed moments. With the two providers in this overview that costs from €1,250 per month, or from €299 per month if an AI system does the testing. That last provider itself writes that this does not replace a manual pentest.
Exposentry's advice, as a rule of thumb: start with a free test. If you expose more than a website and mail to the internet, a continuous external scan is a reasonable next step; that can also be an inexpensive scanner you operate yourself. A pentest comes in once you have your own web application or customer portal with a login, process sensitive data, or a customer or auditor asks for one. More on this in pentest or vulnerability scan.
Additional costs, insurers and subsidies
On top of the quote come the hours of your own IT administrator for scoping and supervision, the remediation work after the findings and possibly a retest.
Insurers can make a pentest a condition (in Dutch) for cyber insurance, and then want that test to be of good quality. According to the CCV, which manages the quality mark, more and more insurers (in Dutch) asked for a tester with the quality mark in 2022. Some insurers give a discount if you take out their own prevention service; NN, for example, gives a 10% discount (in Dutch) on its cyber insurance in combination with its prevention package.
As of October 2026, no national subsidy in the Netherlands for a pentest or vulnerability scan can be found. The Mijn Cyberweerbare Zaak (in Dutch) scheme (50% of the costs, up to €1,250, applications until 30 November 2026 inclusive) only covers eight types of measures; a pentest or scan is not among them, and measures for websites are excluded as well. Provinces sometimes offer an advisory voucher. Drenthe (in Dutch), for example, covers half of an advisory project, up to a maximum subsidy of €3,000, for businesses in the province; the scheme mentions cybersecurity, although a pentest is not named in it.
What does NIS2 monitoring cost?
The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) requires appropriate measures against the risks to your organisation, and that you can demonstrate you take them. Which measures those are is explained article by article on the page about the Cybersecurity Act. The law largely leaves it to you which means you use to demonstrate this.
The European Implementing Regulation 2024/2690 explicitly names security testing, and where appropriate vulnerability scans, for providers of cloud services, data centres, managed IT services and DNS services, among others. What NIS2 monitoring costs depends on what a service measures and what evidence it produces: only your external attack surface or your internal network too, how often it measures, whether it produces a dated report and whether someone goes through the outcome with you. A certificate shows how you have set up your security, a measurement what it found on your external attack surface on a given day; the two complement each other.
Where Exposentry sits in this overview
| Plan | Price excl. VAT | What it includes |
|---|---|---|
| Baseline scan | €495 one-off | One domain, a sealed report, a half-hour discussion with a specialist; runs for two months, after which you decide whether to continue |
| Ketenpartner | €249 per month | Up to 10 domains, continuous reconnaissance of what you expose to the internet (ports, certificates, web servers), an automatically compiled and sealed report every month, email support, and per domain, with your consent, also active tests for known vulnerabilities (level 3) |
| NIS2 Monitoring | €495 per month | As Ketenpartner, plus extended active tests for known vulnerabilities and personal interpretation by a specialist every quarter |
| NIS2 + Supply Chain | €795 per month | As NIS2 Monitoring, plus 10 suppliers whose external attack surface is followed through public sources, and four consultancy hours per quarter |
With annual payment you get two months free. If you switch to an annual subscription within 60 days of the Baseline scan, the full amount of the Baseline scan is credited.
This is how the plans compare with the market. The Baseline scan falls within the range of one-time scans. For ten domains, Ketenpartner is more expensive than the Dutch scanners you operate yourself: there you pay €79 to €99 per month for ten or more domains. NIS2 Monitoring costs the same as the most expensive managed scan for one domain in the overview, and covers up to ten domains. With that managed scan, findings are validated with exploit scripts, ethical hackers prioritise them every month and the internal network is measured too; with Exposentry there is an interpretation every quarter and only your external attack surface is measured. NIS2 + Supply Chain is above the highest fixed monthly amounts in the scan table.
Exposentry digitally seals the report, with a timestamp from an independent service, so that a customer or auditor can check that it has not been changed since it was sealed. In the NIS2 plans a specialist goes through the outcome with you every quarter. The extended tests there only start after you have shown in two ways that the domain is yours: with a record in your DNS settings and with a file on your website. You pay for the domains you register; subdomains the scan finds behind them cost nothing extra.
Exposentry only measures your external attack surface. For your internal network or a manual test you need an internal scan or a pentest, as described above. The measurement comes from OpenKAT, the open-source security scanner developed within the Dutch government and maintained by the LibreKAT Foundation (Stichting LibreKAT) since 2026. You can also install OpenKAT yourself for free; the NCSC lists it on its tools page (in Dutch). With Exposentry you pay for the hosting, the management, the report and, in the NIS2 plans, the interpretation.
If you only need an overview for yourself, a free test or an inexpensive scanner you operate yourself is a reasonable choice. If you have to show the result to a customer or regulator, the evidence carries more weight. You can start with the free check of your mail security (DMARC), of your website's certificate (SSL) or with the security scan. What Exposentry's external scan measures and what the report contains is on the vulnerability scan page; the plans are on the pricing page.
How to compare quotes
| Question | Why it matters |
|---|---|
| What falls within the scope, as a list of domains, IP addresses, user roles and connections with other systems? | A vague scope makes a test expensive or superficial |
| How many test days or hours, and is it a fixed price or charged afterwards on actual hours? | A day rate only means something with the number of days attached |
| Which test method: black, grey or white box? | Determines how much time goes into reconnaissance |
| Who tests, with which qualification, and are subcontractors used? | The CCV quality mark and certifications say something about the quality |
| What is in the report? | A management summary, severity per finding and steps your administrator can reproduce |
| Is a retest included in the price? | Shows that what you fixed is closed |
| When is testing done, and which systems are left out? | A test on your live systems or outside office hours can cost more |
| Who signs the indemnification (the written permission for the test), does your hosting provider give permission, and is the provider insured for damage during the test? | You give permission to attack your systems; record who is responsible for what |
| What counts as one unit in a scan, and who assesses the alerts? | The billing unit and the follow-up work determine what you actually spend |
Also watch out for VAT: many providers do not state whether their price is including or excluding VAT. How to check whether a report has been altered afterwards is explained in verifying an Exposentry report.
In depth: the sources behind the ranges
All prices were retrieved on 28 October 2026 from the sites of the providers and sources. Most pentest amounts come from parties that sell pentests themselves; the KVK and the NCSC are the only neutral sources, and the NCSC gives no amounts.
- Scans: self-operated at Fortivox Security, Exposure Watch, Pentest-Tools.com and Intruder. Internal at kwetsbaarheidsscan.nl and Promax. Managed at Tozetta and SecuroNova. One-time at SecuroNova (€450), Mijn Bedrijf Online (from €299 per host) and Secure Audit. Per user and free questionnaire at Lupasafe. Certificate route at Samen Digitaal Veilig, free questionnaire at the NIS2 Cyber Score. Free tests: internet.nl, the NCSC tools, the free versions of the four self-operated scanners above and the supply-chain scan (ketenscan) of 1338.nl, which calls itself an inventory and not a vulnerability scan.
- Pentests: Tozetta, Warpnet, Surelock, Budget Security, Secure Audit, Q-Cyber, Sectricity, EHGI, the market survey by IBgids (EHGI and IBgids publish the same table and count as one source) and the German compliance software vendor Matproof as a secondary source. Pentest as a subscription: Warpnet and, with an AI system, Securitytest.nl.
Exposentry is not included in the ranges. Its own prices are in the table above.
Frequently asked questions
What does a vulnerability scan cost? A one-time scan with a report costs roughly €300 to €2,000. An external scan you operate yourself costs €29 to €399 per month with Dutch providers, often with a free version. An internal network scan with a device in your network starts at around €89 per month. If you have specialists prioritise the findings, that costs €295 to €750 per month with the providers in this overview. Reference date 28 October 2026.
What does a pentest cost? A pentest is priced per test day. The usual day rate is between €1,000 and €2,000. A pentest of one web application typically costs €3,000 to €15,000, a test of your internal network €4,500 to €15,000. For a few hundred euros, what you get in practice is an automated scan.
How long does a pentest take? The test itself usually takes 3 to 10 working days. One market survey puts it at two to four weeks from intake to report; when you can start differs per provider.
Is a retest included? With some providers it is, with others it is not. Ask before you sign: a retest shows that what you fixed is really closed.
Will an insurer or a subsidy cover the costs? As of October 2026, no national subsidy in the Netherlands for a pentest or vulnerability scan can be found. The Mijn Cyberweerbare Zaak scheme only covers eight types of measures, and a pentest or scan is not among them. Insurers can make a pentest a condition. Some insurers give a discount if you take out their own prevention service.
What does NIS2 monitoring cost at Exposentry? A one-time Baseline scan costs €495. Ketenpartner costs €249 per month, NIS2 Monitoring €495 per month and NIS2 + Supply Chain €795 per month, all amounts excl. VAT. With annual payment you get two months free. What each plan includes is on the pricing page.
Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.