If you run an SME in Switzerland, the question of how much a penetration test costs is legitimate, but there is no one-size-fits-all answer. The price range in Switzerland is wide and depends on numerous factors. This guide provides concrete benchmarks and explains what drives the price.
Cost Overview by Test Type
Web Application Pentest
| Scope | Price Range | Duration |
|---|---|---|
| Small web application (login, few functions) | CHF 5,000 – 10,000 | 2–3 days |
| Medium web application (e-commerce, portal) | CHF 10,000 – 25,000 | 5–10 days |
| Complex web application (SaaS, banking) | CHF 25,000 – 60,000 | 10–20 days |
External Network Pentest
| Scope | Price Range | Duration |
|---|---|---|
| Small network (1–10 IPs) | CHF 5,000 – 12,000 | 2–5 days |
| Medium network (10–50 IPs) | CHF 12,000 – 25,000 | 5–10 days |
| Large network (50+ IPs) | CHF 25,000 – 50,000 | 10–15 days |
Internal Network Pentest
| Scope | Price Range | Duration |
|---|---|---|
| Single location | CHF 8,000 – 20,000 | 3–5 days |
| Multiple locations | CHF 20,000 – 50,000 | 5–15 days |
Mobile App Pentest
| Scope | Price Range | Duration |
|---|---|---|
| iOS or Android individually | CHF 8,000 – 15,000 | 3–5 days |
| iOS and Android plus backend | CHF 15,000 – 35,000 | 7–12 days |
Red Teaming (Detailed)
| Scope | Price Range | Duration |
|---|---|---|
| Focused red teaming | CHF 30,000 – 60,000 | 2–4 weeks |
| Complete red teaming | CHF 60,000 – 150,000 | 4–8 weeks |
What Factors Influence the Price?
1. Scope and Complexity
The most important price driver. The more systems, applications, and networks tested, the higher the cost. A simple website check costs significantly less than a in-depth test of the entire IT infrastructure.
2. Test Depth
- Automated scan: Inexpensive but superficial (not a real pentest)
- Standard pentest: Systematic examination using manual techniques
- Extended pentest: In-depth analysis including business logic tests
- Red teaming: Realistic attack simulation across all vectors
3. Provider Certification
CREST-certified providers tend to charge higher day rates but offer internationally recognised quality standards. For regulated industries, certification may be a prerequisite. CREST-certified providers like RedTeam Partners combine Swiss market knowledge with internationally benchmarked testing methodologies, which can be particularly valuable when reports need to satisfy both local regulators and global compliance frameworks.
4. Time Pressure
Express tests with short lead times typically cost 20–30% more than regularly planned engagements.
5. Reporting Requirements
A management summary for the board costs less than a detailed technical report with reproduction steps for every vulnerability.
What Should a Good Pentest Include?
Ensure the following services are included in the proposal:
- Scoping workshop: Joint definition of the test scope
- Execution: Manual and automated testing
- Detailed report: Vulnerabilities with risk assessment and remediation recommendations
- Debriefing: Presentation of results for management and technical teams
- Retest: Verification that fixed vulnerabilities are actually resolved (often at additional cost)
Typical Budgets by Company Size
| Company Size | Annual Security Testing Budget | Recommended Measures |
|---|---|---|
| Small SME (1–20 employees) | CHF 5,000 – 15,000 | Annual webapp pentest |
| Medium SME (20–100 employees) | CHF 15,000 – 40,000 | Webapp + network pentest |
| Larger SME (100–250 employees) | CHF 40,000 – 100,000 | Full + social engineering |
| Large enterprise (250+ employees) | CHF 100,000+ | Red teaming + continuous testing |
Common Mistakes in Provider Selection
- Focusing only on price: The cheapest provider rarely delivers the best test
- Not checking references: Ask for references from your industry
- Accepting automated scans as pentests: A tool report is not a pentest
- Not clearly defining scope: Unclear scope leads to additional costs or incomplete coverage
- Not planning a retest: Without a retest, you do not know if the fixes work
When a Penetration Test Pays Off
A pentest is not a luxury but an investment. For comparison: the average cost of a ransomware attack for a Swiss SME is CHF 100,000 to CHF 500,000, not counting reputational damage. An annual pentest for CHF 10,000–25,000 is a manageable insurance policy.
Transparency Note
RedTeam Partners is a cybersecurity company holding the Alpine Excellence seal. This guide was written independently. The prices cited are based on market research and publicly available information.