In 2026, the penetration testing cost in Bangladesh usually falls between BDT 35,000 and BDT 90,000 for a single small web application. A mid-size scope covering web, mobile and API typically runs from BDT 1,00,000 to BDT 4,00,000. A full-scope VAPT for a bank, PSP or large enterprise often costs BDT 5,00,000 to BDT 25,00,000 or more.
That is a wide range, and it confuses many buyers. Two vendors can quote BDT 20,000 and BDT 2,00,000 for what looks like the same job. Usually they are not selling the same thing at all.
This guide explains what drives pentest pricing in Bangladesh and what a fair price looks like for each type of test. It also shows how to compare quotes so you pick a company that actually finds your risks, not just the cheapest PDF report.
Quick answer: budget roughly BDT 10,000 to BDT 35,000 per tester-day with a qualified local firm. A small web app needs 4 to 8 tester-days, while a regulated financial institution may need 30 to 100 or more. Prices are usually quoted excluding VAT. Always ask how many days of manual testing your quote includes.
What are you actually paying for in a penetration test?
A penetration test is an authorised, simulated cyberattack on your application, network or cloud. Skilled testers try to break in the way a real attacker would. They then prove the impact and tell you exactly how to fix each issue.
Many price differences in Bangladesh come from vendors using the same name for very different services:
| Service | What happens | Depth | Typical use |
|---|---|---|---|
| Automated vulnerability scan | A tool (Nessus, Acunetix, Burp Scanner) runs and exports a report | Low: misses business-logic and access-control flaws | Monthly hygiene check |
| Vulnerability Assessment (VA) | Scan plus manual validation to remove false positives | Medium | Infrastructure baseline, patch tracking |
| Penetration Test (PT) | Manual exploitation, chaining issues, proving real impact | High | Pre-launch, annual testing, after major changes |
| VAPT | VA and PT combined in one engagement | High and broad | Regulatory and compliance requirements |
| Red team | Goal-based attack across people, process and technology | Very high | Mature organisations testing detection and response |
If a quote says "penetration test" but the price fits a scan, ask how much of the work is manual. A real pentest is mostly human effort, and human effort is what you pay for. For a deeper look at the difference, read VAPT vs penetration testing: what's the difference?
Penetration testing cost in Bangladesh: 2026 price table
The table below shows indicative 2026 market ranges for qualified local firms. Prices are in BDT and exclude VAT. Your final quote depends on scope, which the next section explains.
| Test type | Typical scope | Effort (tester-days) | Price range (BDT, excl. VAT) |
|---|---|---|---|
| Automated scan with validated report | Up to 10 IPs or 1 website | 1 to 2 | 10,000 to 30,000 |
| Small web application pentest | Up to about 20 pages, 1 to 2 user roles | 4 to 8 | 35,000 to 90,000 |
| Medium or complex web application | Many roles, payments, admin panel | 8 to 20 | 90,000 to 3,00,000 |
| Mobile app pentest (Android or iOS) | One platform, with its backend API | 5 to 12 | 40,000 to 1,50,000 per platform |
| API security testing | 20 to 60 REST or GraphQL endpoints | 4 to 12 | 40,000 to 1,50,000 |
| External network / perimeter | 5 to 25 public IPs | 3 to 8 | 30,000 to 1,00,000 |
| Internal network and Active Directory | 50 to 250 hosts | 8 to 20 | 1,00,000 to 3,50,000 |
| Cloud configuration review (AWS, Azure, GCP) | One account or subscription | 4 to 12 | 40,000 to 1,50,000 |
| AI / LLM application testing | One chatbot, RAG or agent app | 4 to 12 | 50,000 to 2,00,000 |
| Secure source code review | About 50,000 lines of code | 5 to 15 | 80,000 to 3,00,000 |
| Full-scope VAPT for a bank, PSP or MFS | Apps, APIs, network, card and config review | 30 to 100+ | 5,00,000 to 25,00,000+ |
| Red team exercise | 4 to 8 weeks, goal-based | 40 to 120 | 15,00,000+ |
| Re-test (fix validation) | Same findings, after remediation | 1 to 4 | Often included, or 10% to 25% of the test fee |
A few notes on reading these numbers:
- Bundles cost less. Testing web, mobile and API together usually costs 15% to 30% less than buying each one separately.
- VAT and tax. Ask whether VAT is included. Pentesting is usually billed as an IT-enabled service, and tax may be deducted at source on payment.
- Payment terms. Milestone payments are common, for example advance, draft report and final report.
- International vendors billing in USD often cost several times more for a similar scope. They make sense when a foreign client or auditor requires a specific accreditation.
9 factors that decide your pentest price
Behind every serious pentest quote is one estimate: how many tester-days it takes to cover your scope properly. These factors change that number.
- Scope size. This means the number of applications, pages, API endpoints, IP addresses or cloud accounts. More assets need more days.
- Application complexity. Five user roles, a payment flow and an admin panel need far more testing than a brochure website. Most serious bugs hide in business logic and access control.
- Testing approach. Black-box testing (no access) is quick but shallow. Grey-box testing (test accounts and API docs) finds more per taka, and most experts recommend it. White-box testing adds source code and costs the most.
- Asset type. Mobile apps need reverse engineering and runtime testing. Internal networks need Active Directory attack paths. AI and LLM apps need prompt injection and data-leakage testing.
- Compliance requirements. A Bangladesh Bank, PCI DSS or ISO 27001 audit needs specific evidence, mapping and report formats. That adds documentation time.
- Tester skill and certifications. Senior testers with OSCP, OSWE, CREST, GPEN or similar credentials cost more per day. They also find more in fewer days.
- Re-testing and support. Some vendors include one free re-test and a remediation call. Others charge for every follow-up.
- Timeline and testing window. Rush jobs, night-time testing on production, or weekend-only windows usually cost extra.
- Onsite work. Internal network tests that need a tester at your office or data centre add travel and setup time.
Why is demand for pentesting in Bangladesh rising in 2026?
For many organisations, a pentest is no longer optional. Regulators, auditors and enterprise customers now ask for proof of testing.
| Requirement | Who it affects | What it means for testing |
|---|---|---|
| Bangladesh Bank Cybersecurity Framework v1.0 (2026) | Scheduled banks, finance companies, MFS providers, PSPs and payment system operators | Issued on 29 March 2026, with compliance required by 31 December 2026. It covers audit and compliance assurance, third-party security and a secure SDLC, and requires VAPT at least once a year. |
| Bangladesh Bank Guideline on ICT Security v4.0 | Banks, NBFIs, MFS, PSPs, PSOs and white-label ATM operators | Sets minimum ICT security controls, including half-yearly internal scans and penetration testing at least once a year. |
| Cyber Security Act 2026 | Critical information infrastructure and digital service operators | Passed by Parliament on 10 April 2026, replacing the Cyber Security Ordinance 2025. |
| Personal Data Protection law | Any business that processes personal data of people in Bangladesh | Requires the confidentiality, integrity and security of personal data. Regular testing is the clearest way to show reasonable security. |
| PCI DSS v4.0 | Merchants and payment processors that handle card data | Requires internal and external pentests at least once a year and after significant changes. |
| ISO/IEC 27001:2022 and SOC 2 | Software, SaaS, BPO and export-oriented companies | Auditors expect evidence of vulnerability management and security testing. |
Tenders and enterprise customers are another driver. Many now ask vendors for a recent third-party pentest report before they sign a contract.
Laws and guidelines change. Confirm the current version with your compliance team or legal advisor.
What is the real cost of a cheap pentest?
A cheap pentest is expensive if it misses the bug an attacker finds later. A data breach brings incident response costs, regulatory scrutiny, lost customers and damage to your reputation. Even one serious incident can cost far more than years of proper testing.
The most common problem in the Bangladesh market is a scan sold as a pentest. The vendor runs a tool for a few hours, adds a logo and sends a 200-page PDF. Scanners are useful, but they rarely find the flaws that cause the worst breaches (see why automated scanning isn't enough):
- Broken access control, such as one customer seeing another customer's data (IDOR/BOLA)
- Business-logic abuse, such as changing a price, skipping a payment step or reusing a coupon
- Authentication and session flaws, such as OTP bypass or weak password-reset flows
- Chained attacks, where three "low" issues combine into a critical one
Red flags in a pentest quote
- A fixed low price given before the vendor understands your scope
- No mention of tester-days or how much of the work is manual
- No testing methodology named, such as OWASP WSTG, OWASP MASVS or PTES
- No sample report available, or the sample is just raw scanner output
- Report delivered in one or two days for a complex application
- No re-test included, and no clear price for one
- No NDA, no rules of engagement and no written authorisation before testing starts
- The vendor cannot name who will do the testing or what their credentials are
- A promise of "100% secure" or "zero vulnerabilities". No honest tester can promise that.
How do you choose the right penetration testing company in Bangladesh?
The best pentest company is not the cheapest or the most expensive one. It is the one that finds your real risks and helps you fix them. Compare vendors on value delivered, not just price.
10 questions to ask before you sign
- How many tester-days are in this quote, and what share is manual testing?
- Who exactly will test our systems, and what certifications and experience do they have?
- Which methodology do you follow, such as OWASP WSTG, OWASP MASVS, OWASP API Top 10, PTES or NIST SP 800-115?
- Can we see a redacted sample report?
- Do you test business logic and access control with multiple user roles?
- Is a re-test included, and within what time window?
- Do you have experience with our sector, such as banking, fintech, e-commerce, telecom or SaaS?
- How do you handle our data, test credentials and findings? Do you sign an NDA?
- Do you map findings to the compliance standard we need, such as Bangladesh Bank guidelines, PCI DSS or ISO 27001?
- Will you walk our developers through the findings and how to fix them?
What should a good pentest report contain?
- An executive summary that management can read in five minutes
- Each finding with a risk rating (CVSS or similar), affected asset, proof of concept and business impact
- Step-by-step reproduction so your developers can verify the issue
- Clear, practical remediation advice for your technology stack
- Scope, dates, methodology and any limitations stated honestly
- A re-test report confirming which issues are fixed
Vendor comparison scorecard
Score each shortlisted vendor from 1 to 5 on each criterion, then multiply by the weight. The highest total usually beats the lowest price.
| Criterion | Weight | What a 5 looks like |
|---|---|---|
| Tester skill and certifications | 20% | Named testers with OSCP, OSWE, CREST or similar, and relevant past work |
| Manual testing depth (tester-days) | 20% | Tester-days stated in writing, mostly manual work |
| Report quality (sample report) | 15% | Proof of concept, business impact and stack-specific fixes for every finding |
| Sector and compliance experience | 15% | Findings mapped to the standard your auditor uses |
| Re-test and remediation support | 10% | Re-test included, plus a walkthrough with your developers |
| Data handling, NDA and legal paperwork | 10% | NDA, rules of engagement and written authorisation before testing |
| Price and payment terms | 10% | Clear scope-based quote with milestone payments |
| Weighted total | 100% | Compare totals, not just the price line |
How do you get an accurate quote and save budget?
The clearer your scope, the more accurate and comparable your quotes will be. Send every vendor the same information:
- Web apps: URLs, approximate number of pages, user roles and key features such as payments or file uploads
- Mobile apps: platforms (Android, iOS or both) and whether test builds are available
- APIs: number of endpoints, plus documentation such as Swagger/OpenAPI or a Postman collection
- Networks: number of external IPs and internal hosts, and whether Active Directory is in scope
- Cloud: provider (AWS, Azure or GCP) and number of accounts or subscriptions
- Compliance: the standard or regulator the report must satisfy, and any deadline
Practical ways to lower cost without lowering quality
- Choose grey-box testing. Giving testers accounts and API docs saves days of guessing and finds more issues.
- Bundle related assets. A web app, its mobile apps and their shared API tested together avoids paying for the same backend three times.
- Fix the basics first. Patch known vulnerabilities and run a scan before the pentest. Then paid tester time goes to deeper issues.
- Prioritise by risk. Test internet-facing, payment and customer-data systems first. Low-risk internal tools can wait.
- Plan an annual cycle. Annual agreements, or retesting after each major release, usually get better rates than one-off urgent jobs.
- Make sure re-testing is included, so you are not charged again just to prove a fix works.
How does PentesterSpace quote a penetration test?
We price every engagement from the scope you agree with us, not from a fixed rate card. Each quote states what is in scope, the testing approach, the timeline and the retest terms, so you can compare it line by line with any other vendor's. Requesting a quote is free.
- Focused one-time pentest for a release, audit or high-risk application, with an executive and technical report and one complimentary retest after you fix the findings.
- Continuous PTaaS for teams that ship often, with reusable testing capacity and on-demand retesting.
- Managed programme for broad attack surfaces that need a vetted researcher community.
See how the three models compare on our pricing page, or send your scope through the Get started form and our experts will respond within 6 hours.
Frequently asked questions
How much does a penetration test cost in Bangladesh?
In 2026, a small web application pentest typically costs BDT 35,000 to 90,000. A mid-size web, mobile and API scope costs BDT 1,00,000 to 4,00,000. A full-scope VAPT for a bank or PSP often costs BDT 5,00,000 to 25,00,000 or more. These prices exclude VAT.
Why do pentest quotes vary so much?
Vendors quote different amounts of manual work. A low quote is often an automated scan. A higher quote usually includes more tester-days, senior testers, business-logic testing and a re-test.
How long does a penetration test take?
A small web app takes about 1 to 2 weeks, including reporting. A multi-asset scope takes 3 to 6 weeks. A full bank VAPT can take 2 to 3 months.
How often should we do a penetration test?
At least once a year, and after any major release, infrastructure change or merger. Regulated financial institutions and PCI DSS entities are generally expected to test at least annually.
Is VAPT mandatory for banks in Bangladesh?
Yes. Bangladesh Bank's ICT Security Guideline requires regulated institutions to run half-yearly internal vulnerability scans and penetration tests at least once a year. Its new Cybersecurity Framework must be implemented by 31 December 2026. Check the current circulars with your compliance team.
Is a vulnerability scan enough?
No. Scanners find known weaknesses, but they miss access-control and business-logic flaws. Those flaws often cause the most damaging breaches. Use scans for regular hygiene and pentests for depth.
Black-box, grey-box or white-box: which is best?
For most businesses, grey-box testing gives the best value. Testers get user accounts and documentation, so they spend their time finding real issues instead of guessing.
Can a pentest damage our live systems?
A professional tester agrees rules of engagement with you first. These cover testing windows, excluded systems and emergency contacts. They avoid destructive tests on production unless you approve them. Testing on a staging copy of production is often the safest option.
Should we choose a local or an international pentest company?
A qualified local firm usually offers better value, faster communication and knowledge of Bangladesh Bank and local requirements. An international or specifically accredited firm makes sense when a foreign client or auditor requires it.
Final thoughts: pay for depth, not for pages
The right question is not "What is the cheapest pentest?" It is "How many real risks will this test find, and will my team know how to fix them?" Define your scope clearly and ask every vendor the same questions. Then compare them on tester-days, skill, report quality and re-test support. You will quickly see which quote offers real value.
Want a clear, no-surprise quote? PentesterSpace is a Bangladesh-based penetration testing company. We test web and mobile applications, APIs, networks, cloud environments and AI/LLM applications. Share your scope or book a call.
- Email: contact@pentesterspace.com
- Phone: +880 1765-323081
Sources
- Cenbank introduces new cybersecurity framework for financial sector, The Business Standard
- Bangladesh Bank Guideline on ICT Security compliance overview, Thales
- CREST CMAGE research assessment: Bangladesh, CREST
- Parliament passes Cyber Security Bill-2026, DigiBangla Tech News
- Bangladesh's Personal Data Protection Ordinance 2025: key takeaways, The Daily Star
Price ranges are indicative 2026 market figures for qualified local firms, for general guidance only. They are not a PentesterSpace rate card or an offer; every engagement is quoted on its agreed scope.
All articles