How much does a security test cost for a small app?
It ranges from free to many thousands of pounds. Automated scanners are free or cheap but only find surface issues. Accredited penetration tests are usually priced by the day and often cost several thousand pounds. In between, person-checked assessments like Elitor's start at £249 for a one-off check, with a free check to start.
The main options
- Automated scanners: free to low cost. Good for headers, outdated software and obvious exposures. They cannot tell whether one user can reach another user's data, which is where most serious problems are.
- Freelancers on marketplaces: prices vary widely, and so does quality. Ask what is tested by hand and whether findings are verified.
- Person-checked assessments: a person tests your app like an attacker would and confirms every finding. Elitor's one-off checks start at £249, and ongoing monthly testing at £99 a month.
- Accredited penetration tests (for example CREST): usually priced per day of testing and needed for some compliance, insurance or procurement requirements.
What you should get for the money
- Findings that a person has confirmed are real, not a list of maybes.
- Clear steps to fix each one.
- A retest to confirm the fixes worked.
- A report you can show investors or customers.
Do you need an accredited pentest?
Only if a rule or a customer requires one, for example PCI DSS validation or some financial-services and insurance requirements. For most early-stage apps, a person-checked assessment finds the same practical problems for much less. Elitor is not CREST accredited and will tell you if you need a provider that is.
Start for free
Elitor's free check is a quick first look at your app, and we confirm the price of any paid check before you pay anything.
Last updated 2026-10-21.