How Much Does a Website Security Test Cost? 6 Things to Check on Your Quote

The short answer: the cost of security testing depends mainly on how many targets are tested and how deep the testing goes. Two services that are both called "website testing" can differ a lot: one is an automated scan, the other is a person simulating an attack, so the workload and the price are different. Using ThunderShield's published plans as an example (prices captured on 2026-11-05, excluding tax; the pricing page and your written quote are the final reference), a Web Vulnerability Detection for one website starts at NT$26,000 and a Penetration Testing engagement starts at NT$79,900.

What Determines a Quote

1. Number of targets: how many websites or hosts are tested. More targets mean more working time.
2. Depth of testing: vulnerability detection uses automated tools to scan for known weaknesses; penetration testing has security professionals simulate real attackers and go further to validate whether a weakness can actually be exploited.
3. Environment: production systems are usually tested off-peak or on weekends, at a time agreed with you, which affects scheduling.
4. Whether a retest is included: a retest verifies again after fixes are made, to confirm the same issues have been remediated.
5. Report and turnaround: what the report contains and how many days delivery takes.
6. Code size or traffic size: code testing is sized by lines of code; stress testing by the number of simulated concurrent users (VU).

How We Count a "Target"

The most common point of dispute on a quote is what counts as "one target". Here is how we count it. Other providers may count slightly differently, so align on this before you sign:

• One target is one website hostname (for example www.example.com) or one IP address.
• All paths and pages under the same hostname count as one target. We do not price by page count.
• A different hostname (for example another subdomain such as api.example.com) counts as another target.

Our Published Plans (excluding tax; 5% business tax extra; captured 2026-11-05)

Service	Price	Scope included	Turnaround
Host Vulnerability Detection	NT$15,000	1-10 IPs	Within 3 business days
Web Vulnerability Detection	NT$26,000	1 website	Within 3 business days
Static Application Security Testing	NT$39,900	Within 300,000 lines	Within 3 business days
Web Stress Testing	NT$49,900	1,000 VU (base package)	Within 3 business days
Phishing Simulation	NT$59,900	Up to 100 mailbox accounts; two independent drills per year	5 business days scenario design + 2-4 weeks per drill execution window
Penetration Testing	NT$79,900	1 IP or 1 website	7 working days of testing, report delivered within 3 working days

• Except for Phishing Simulation, each price includes one initial test and one retest.
• Beyond the included scope: for Host Vulnerability Detection, each IP from the 11th onward is an additional NT$600 (excluding tax); for Web Vulnerability Detection and Penetration Testing, each additional target is charged at the same price; for code beyond 300,000 lines, and for stress testing or phishing simulation beyond the base scope, we evaluate separately or price by tier, so please contact our sales team.
• Customers who sign a three-year framework agreement may receive a 5% to 15% tiered discount based on cumulative annual purchase amount.

When You Get a Quote, Check These 6 Things First

1. Target list: is every URL and IP listed one by one? A quote that just says "lump sum" is hard to compare.
2. Type of testing: is it a vulnerability scan or a penetration test? Does it say who performs it and how?
3. Retest: how many are included? Is anything beyond that charged separately?
4. Report: what format is delivered? Is there an executive summary as well as technical detail?
5. Timeline: how many days for testing and how many for report delivery?
6. Tax and overage rules: is tax included in the price? How is the price calculated when targets increase?

How to Prepare to Get an Accurate Quote

Gather these first: the list of website URLs or IPs to be tested, the system go-live date, whether a test environment exists, how many user roles there are, and when you would like to start. The clearer the list, the less likely the quote is to change midway.

FAQ

What is the difference between vulnerability detection and penetration testing?

Vulnerability scanning is automated; penetration testing involves security professionals simulating real attackers to validate actual exploitability.

Is the retest for the same set of issues?

Yes. The retest verifies whether the issues found in the initial test have been remediated.

Can testing affect my website's normal operation?

Our scans are designed to detect weaknesses. We coordinate the testing window with you; production systems are typically scheduled off-peak or on weekends, with scan rates reduced where needed. If your website has data-writing functions, we confirm the test scope with you in advance to limit impact on your services and data.

Is my test data kept confidential?

All engagements are covered by an NDA. Test data is never disclosed externally and is destroyed upon project completion.

Next Step

To see which scope your website roughly falls into, compare it on the pricing page, or contact us with your list of URLs and we will reply with a quote based on the scope.