How much does penetration testing cost in Lithuania in 2026?

2026-11-01 · Market analysis

Atakos vektorius carried out a study of how much penetration testing (pentesting) costs in Lithuania in 2026, analysing public sector procurement, the private market and a comparison with Germany, Poland and the US. This article sets out real price ranges by project scope.

Why is this question so hard to answer?

“How much does a pentest cost in Lithuania?” sounds like a simple question, but you will not find a single clear figure on the market. Of roughly twenty penetration testing providers operating in Lithuania, only a few companies mention an indicative starting price on their websites (“from EUR X” or a parametric calculator), and none of them specifies what scope of work that amount actually buys. The rest only respond once they receive an enquiry, and the first offer is often tailored individually.

Meanwhile, organisations considering security testing for the first time have no reference points and receive offers that differ by a factor of 5–10. That makes comparing offers almost impossible.

The aim of this article is to provide price ranges grounded in specific procurement cases and cost calculations. The first source is Lithuanian public procurement data (the new viesiejipirkimai.lt portal, in place since 2024, and TED.europa.eu): six cases with published values that show the exact scope (from a single web application to eight information systems), the required team certifications and the duration. The second source is the private market: a review of 21 providers’ websites and a salary baseline from which the cost of a tester’s work and the day rate are derived. The third source is a comparison with the German, Polish and US markets, adjusted for purchasing power parity (PPP).

First things first: what does “pentest” actually mean?

Before comparing prices, it is necessary to distinguish between three services that are often lumped together under one name in public, but cost different amounts and deliver different results.

Vulnerability assessment is a process for detecting and evaluating vulnerabilities in IT infrastructure, networks, applications and systems. It can be carried out automatically or semi-automatically using specialised tools, and the results are presented in a report together with an expert assessment and prioritisation of critical issues. Organisations use this method frequently because it identifies a large share of vulnerabilities quickly and efficiently at relatively low cost. However, such an assessment usually provides only an assumption about possible vulnerabilities or attack vectors. Whether they can actually be exploited in practice, and how the security controls behave when they are, is what penetration testing shows.

Penetration testing is a security testing process in which cybersecurity specialists actively attempt to exploit vulnerabilities and attack vectors in order to assess how real threat actors could compromise a system, gain unauthorised access or reach sensitive information. The goal is not only to identify weaknesses but also to confirm that they are actually exploitable, assess the potential impact and determine likely attack scenarios. It is usually project-based, commissioned work carried out periodically (for example, once a year or after significant changes to systems). Testing is typically performed by internal or external cybersecurity experts following recognised methodologies and good practice (OWASP WSTG, PTES or NIST SP 800-115).

IT audit is a comprehensive assessment of an organisation’s information technology environment. It covers not only a technical security check, including vulnerability analysis, but also an evaluation of processes, policies, governance controls, risk management and compliance with laws and standards. An audit usually involves reviewing documentation, assessing the security procedures in place and analysing the organisation’s readiness for incidents and business continuity. The result is a detailed report listing non-conformities, recommendations, a remediation plan and responsibilities. For this reason, when an IT audit is agreed, a comprehensive assessment is usually expected, not just a list of technical weaknesses.

When it comes to price, the first thing to understand is which of these three types of service sits behind the label. A vulnerability assessment often costs several times less than a penetration test, but it also tells you less about the real risk. An IT audit, in turn, can cost as much as a pentest or even more, but it involves completely different work — more documents, interviews and process evaluation than technical testing. In practice these labels are often confused: some providers market a service as a “pentest” but actually deliver audit-style work, and vice versa. An example from the public sector: the 2024 procurement by AB Via Lietuva (the state-owned road management company) has “vulnerability assessment” in its title, yet its technical specification is dominated by audit and risk assessment work, and the team was required to hold PMP plus CISA/CISM/CISSP certifications, not CEH or OSCP.

Lithuanian public sector: how much has the state paid?

Since 2024, the new public procurement portal viesiejipirkimai.lt has aggregated all Lithuanian procurements, including contract award notices with the winning price. This has radically improved price transparency — previously, most procurements published their values only partially. Using the portal’s advanced search for titles containing the Lithuanian word stems “įsilaužim” (intrusion), “pažeidžiam” (vulnerability) and “atsparum” (resilience) over 2024–2026, we found about 100 procurements. Of these, six cases have published values that reveal the price structure.

Skuodas District Municipality (2025-07): “Web testing and security assessment services for the burial data information system”, EUR 2,479 estimated maximum value excluding VAT (21% in Lithuania), 2 months. Scope: 1 web application, black-box external test, 2 automated scanners, OWASP Top 10, GDPR + PCI DSS compliance, retest. No team certifications required — a “qualified specialist” is sufficient [1].

Jonava Hospital, a public institution (2026-04): “Penetration and security testing”, EUR 7,920 excluding VAT (the estimate was EUR 16,240 — a price drop of 51%, the largest in this list), 2 months. Scope: 2 systems deployed in 3 hospitals (Jonava, Biržai, Kretinga) — an Android tablet app for biometric signatures (tested against OWASP MASVS) and an AI consultant system with a patient interface and a real-time translation tool for staff (tested against the OWASP Top 10 for LLM), using a grey-box approach. The procurement is part of an EU-funded AI and e-consent project for three regional hospitals. Team qualification requirements explicitly do not apply (a low-value request for quotations), which explains the record price drop [2].

Ministry of Finance of the Republic of Lithuania (2026-02): “Penetration resistance testing services for the Strategic Management Information System (SVIS)”, EUR 9,438 excluding VAT (the ceiling price in the tender conditions was EUR 15,000 — a price drop of 37%), deadline 2026-04-30 from contract signature on 2026-02-11. Scope: one information system — the publicly accessible version of SVIS; black-box approach (the tester acts as an ordinary internet user); manual and automated testing according to the OWASP Testing Guide, OWASP API Security Top 10 and OWASP ASVS; assessment of resilience to DoS/DDoS attacks, a password audit and checks for unauthorised access. Two stages: initial testing plus retesting after the vulnerabilities have been fixed. The team must include 3 specialists holding PMP/PRINCE2 (project manager), CEH (vulnerability expert) and CISSP/CISM (security management expert) certifications, plus a mandatory “Declaration of compliance with national security requirements”. EU-funded (the “SVIS development” project) [3].

AB Via Lietuva (2024-10): “Risk, security compliance and vulnerability assessment of information resources”, EUR 14,580 excluding VAT, 12 months. The scope is broad: 2 information systems of national significance (EIS, KTVIS) with 11 modules, but the technical specification is dominated by audit and risk assessment work (CPV code 72225000) rather than pure pentesting. The team was required to hold PMP/PRINCE2 + CISA/CISM/CISSP certifications. The contract was won by Baltic Amadeus, with 30% subcontracted to MB Konrema [4].

National Health Insurance Fund — Valstybinė ligonių kasa, VLK (2026-01): “Penetration testing and vulnerability scanning services”, EUR 21,780 excluding VAT, 4 months. The largest scope in this list: 8 information systems (SVEIDRA, DPSDR, FVAIS, EVIS, EDMIS, iDrug, DPLSA, DVS) plus an internal administration information system, the external perimeter with DoS tests, the internal perimeter, and manual web/API testing (SQLi, XSS, authorisation). The team had to include 4 specialists: a PM, CEH (technical vulnerability expert), CISA/CISM (information security expert) and CRISC/CISSP (risk assessment expert). The contract was signed on 2026-01-13 with UAB NRD CS, without subcontracting. The tender attracted 4 suppliers [5].

The range between the cheapest and the most expensive procurement runs from EUR 2,479 (one web application for Skuodas municipality) to EUR 21,780 (a pentest of eight information systems for VLK) — roughly a factor of 9. The difference is explained by scope and the level of team certification. From the two cases where the team composition is also known, day rates can be derived: VLK ~EUR 620–870 per working day (4 specialists, 25–35 working days) and Via Lietuva ~EUR 290–490 per working day (an audit profile without a technical offensive component).

Recent market activity: the NIS2 effect is visible

Beyond the six cases with known values, the viesiejipirkimai.lt portal reveals dozens more 2025–2026 procurements without published amounts. The main active buyers by sector:

Central government institutions: the State Tax Inspectorate (VMI; pentest of the tax accounting information system, EUR 9,075), the Environmental Projects Management Agency (AIVIKS), Vilnius University (data protection compliance + vulnerability assessment).
Healthcare: the Hospital of the Lithuanian University of Health Sciences Kauno klinikos (penetration resistance check), the National Public Health Centre (pentest of the communicable diseases system).
Energy and critical infrastructure: AB Klaipėdos vanduo (OT vulnerability scanning), AB EPSO-G (procurement of a DAST platform for web applications), LITGRID (licences for IDS sensors for critical infrastructure), AB Amber Grid (market consultation on security audit and pentest services).
Centralised procurement: CPO LT, the Central Purchasing Body (vulnerability testing of VIISP components), Vilnius City Municipality Administration (consultation on a centralised scanning solution).

A clear pattern emerges: since 18 October 2024, when the amended Law on Cybersecurity (transposing the NIS2 Directive) came into force, the number of procurements has grown not only among large state companies but also among regional organisations — Jonava Hospital, Skuodas municipality, medium-sized health centres. NIS2 obligations no longer stop at central institutions; they have reached the district level.

What drives the price in the public sector?

The six cases reveal four main cost drivers:

Scope (decisive). A pentest of a single information system starts at EUR 7,920 (Jonava Hospital) or EUR 9,075–9,438 (VMI, the Ministry of Finance’s SVIS). A manual pentest of eight information systems with DoS tests and SQLi costs EUR 21,780 (VLK). That is a 2–3x difference, even though both are called a “pentest”.
Team certification level (the biggest price differentiator). Jonava Hospital’s procurement documents state explicitly that “qualification requirements do not apply” — the result was a 51% drop from the estimated value thanks to a very wide pool of suppliers. For Skuodas municipality, a “qualified specialist” without any specific certification is enough. Via Lietuva required PMP plus CISA/CISM/CISSP (an audit profile). VLK required CEH (offensive), CISA/CISM (audit) and CRISC/CISSP (risk) — four specialists. Every additional certification requirement narrows the pool of suppliers and pushes the price up.
Sector and national security status. The Ministry of Finance procurement required a mandatory “Declaration of compliance with national security requirements”, so only suppliers meeting the requirements of Article 92 of the Law on Public Procurement (VPĮ) concerning high-risk countries could take part. As an NIS2 “important entity”, VLK has additional requirements. Smaller buyers (Skuodas District Municipality, Jonava Hospital), by contrast, set a minimal qualification threshold.
Tender structure and price drop. Request-for-quotation procurements without certification requirements end up 30–50% below the estimated value because of competition: Jonava Hospital (no qualification requirements) dropped by 51% (EUR 16,240 → EUR 7,920), the Ministry of Finance by 37% (EUR 15,000 → EUR 9,438). The higher the qualification threshold, the smaller the price drop. Realistic budgeting needs to take this pattern into account.

In other words, public sector prices are neither “expensive” nor “cheap” in themselves — they reflect a specific combination of scope, requirements and competition. With identical requirements, a private company would receive offers of a similar size from the same suppliers. The difference lies not in the price but in the structure: the public sector adds formal layers of tendering, documentation and accountability that are often simplified in a private contract.

Trend: on 18 October 2024, the amended Law on Cybersecurity came into force, transposing the requirements of the NIS2 Directive. This means that significantly more organisations will be required to test their systems regularly. A procurement boom in 2026–2027 and rising prices driven by demand are likely.

The private Lithuanian market: hidden prices, confusing labels

A review of 21 pentest providers operating in Lithuania (NRD Cyber Security, Squalio, BlueBridge, Heximus, Team Secure, NOD Baltic, Binary RAID, Pentester.lt, Emplos, NOIT, Critical Security, Adwisery, Nortal, several “Big 4” firms and others) reveals two patterns: prices are almost never published, and where they are, service names are often confused with neighbouring categories.

NOD Baltic advertises its service “from EUR 1,000” [6], but the website does not explain what exactly this starting price includes — not the number of hours, package levels, retest policy or level of report detail. Without a defined scope, such a figure works more as a marketing hook than as guidance for the client, and it can create false expectations (for example, that EUR 1,000 buys a full web application pentest including a retest). The remaining 20 providers do not publish even a starting price — a quote is provided only on request. This is not common international practice (Securitum in Poland or binsec in Germany publish their day rates openly), but in Lithuania this opacity is a traditional feature of B2B consultative selling.

The confusion of labels runs in both directions. In the public sector we have already seen the 2024 AB Via Lietuva procurement, which is called a “vulnerability assessment” but whose technical specification is dominated by audit work. The private market shows the opposite case: Zillion Consulting offers the only transparent parametric price calculator found in this review, in which the client selects the scope and receives a specific figure before getting in touch [7]:

Base price: EUR 440
Branches/locations: × EUR 60
Workstations (computers): × EUR 30
Servers: × EUR 60
Network devices, printers and other devices: × EUR 5

However, the company calls this service an “IT audit”, even though it describes it itself as a technical check “from computers and network equipment to data security and licences”. In essence this is a vulnerability assessment (or a technical inventory priced by the number of devices), not a comprehensive IT audit with a review of processes, policies and business continuity as defined at the start of this article. From the client’s point of view this matters for two reasons: the label “IT audit” creates the expectation of a comprehensive assessment with recommendations and a remediation plan, whereas what is delivered is a technical report; and second, a genuine IT audit with a process review usually costs several times more than the calculator’s base price.

So in practical terms, when comparing Lithuanian offers, the name of the service is not enough — always ask for a technical specification that states the testing methodology (OWASP WSTG, PTES, NIST SP 800-115), the scope (size of the web application, number of API endpoints, number of user roles), the retest stages and the report structure. Zillion’s transparent calculator is a positive signal as a model — Lithuanian clients accept parametric pricing; the pentest market should move in the same direction, just with parameters tailored to pentesting.

Further market insight comes from a NovaTech.lt article, “Pentest in Lithuania: company experiences and prices” [8], based on anonymised client cases. It confirms three indicative ranges: a small-scope pentest (a website or a single web application) — EUR 1,500–4,000, 3–5 working days; medium scope (several systems) — EUR 5,000–12,000, 1–3 weeks; comprehensive packages (the entire infrastructure) — EUR 15,000–40,000+. The article also mentions the ratio between markets: “prices in Lithuania are 2–3 times lower than in the US and Western Europe” — which matches our PPP adjustment later in this article. The anonymised examples illustrate well what you actually get for these amounts: a pentest of an online shop for ~EUR 3,000 uncovered a critical vulnerability giving access to the database; an IT start-up’s report ran to 23 pages with 17 vulnerabilities (3 of them critical); in a fintech case, three separate minor weaknesses chained together granted administrator rights.

Important for clients: the price of a pentest is not the final price of security. In one of the cases described by NovaTech, after the pentest the company needed an additional budget of EUR 20,000 for security fixes. A pentest finds the gaps — the remediation work itself is often a separate budget line.

Indirect cost base: what do a tester and the tools cost?

To get a sense of prices even without direct price lists, an indirect cost base is used. A senior tester’s salary in Lithuania, based on Manoalga.lt data plus a 20–40% “niche” premium for the technology sector, is ~EUR 3,500–5,500 gross per month [9].

However, the specialist’s salary is only one side of the equation. Another large cost component, often invisible to clients, is licences for professional commercial tools. Open-source or free tools are not sufficient for an industrial-grade security assessment:

Commercial DAST scanner (e.g. Acunetix, Invicti or equivalent solutions): ~EUR 8,000–10,000+ per year.
Infrastructure and network vulnerability scanner (Tenable Nessus Professional): ~EUR 4,500–5,000 per year.
Web attack analysis and proxy tools (Burp Suite Professional): ~EUR 500 per year per specialist.
Cloud, OSINT and testing infrastructure costs: ~EUR 1,000–2,000 per year.

Maintaining a professional toolkit for one specialist or team costs EUR 14,000–18,000+ per year. Amortised, this adds roughly EUR 1,200–1,500 per month in fixed costs per workstation. So once Sodra (state social insurance) contributions, workplace taxes, commercial tool licences and other overheads are taken into account, the employer’s total cost for a senior specialist reaches ~EUR 6,000–9,500 per month.

Applying a typical B2B consulting markup (2–3x) to this gives an indicative rate of EUR 700–1,800 per working day or ~EUR 90–220 per hour. This interpolation explains why a “from EUR 1,000” starting price may realistically correspond to only 5–10 hours of work — a very narrow scope, not full OWASP Top 10 testing. It also shows clearly why, for the client, ordering periodic testing as a service (e.g. for EUR 2,000–3,000) is financially far more rational than buying licences worth tens of thousands of euros and keeping trained in-house staff to run them.

International comparison: Germany, Poland, US

Foreign markets are much more transparent. Some publicly available day-rate data points (all figures excluding VAT):

Germany (binsec GmbH): EUR 1,260–1,960 per working day, a typical project takes about 5 working days [10].
Poland (Securitum): EUR 640–890 per working day; fixed project price for one application EUR 3,500–14,000 (1–4 weeks) [11].
Poland (market average): from ~EUR 280 (PLN 1,200) for simple tasks with junior specialists to ~EUR 820+ (PLN 3,500+) for expert work on complex projects [12].
Budget Security (lower-cost EU pricing model): from EUR 849 per working day, self-service ordering, OSCP-certified specialists [13].
US (market average): USD 1,000–3,000 per working day (~EUR 920–2,760), and senior certified specialists USD 2,000–4,000 (~EUR 1,850–3,700) [14].

Initial market guidance for a small web application pentest:

Poland: small website, 1–3 working days, ~EUR 590–1,760 [12].
Poland (Securitum, fixed price): one application, 1–4 weeks, EUR 3,500–14,000 [11].
Germany (binsec): typical project EUR 3,000–25,000 [10].
US: web application pentest USD 5,000–30,000 (~EUR 4,600–27,600) [14].

PTaaS (Pentest as a Service) platforms such as Cobalt.io and HackerOne deserve a separate mention. They are rarely used in Lithuania but are becoming the standard in the West. Cobalt.io sells credits: 1 credit equals 8 hours and costs USD 1,500–1,650, while a full web application project costs USD 5,000–8,000 [15]. A traditional HackerOne project costs USD 15,000–50,000, and annual quarterly testing USD 60,000–200,000 [16].

How much should it cost in Lithuania?

To calculate a “Lithuanian equivalent”, a PPP correction based on salary ratios is used. Average gross salaries of penetration testers:

Lithuania: ~EUR 4,500 per month (average between junior and senior, derived from the labour market baseline)
Poland: ~EUR 3,950 per month (PLN 16,878) [17]
Germany: EUR 4,880 per month [18]

This gives three independent estimates of what the same pentest “should” cost in Lithuania:

From the Polish market: EUR 730–1,015 per working day
From the German market: EUR 910–1,415 per working day
From the US market (after PPP correction): EUR 550–1,660 per working day

The three methods converge on a range of EUR 700–1,500 per working day, with a typical average of EUR 900–1,100 per working day. This is consistent with the figures derived earlier from the Lithuanian labour market baseline (700–1,800), but the PPP analysis narrows and confirms the range.

Prices by project scope

Average market price: a typical web application pentest combining automated tools with manual testing costs from EUR 3,000. It takes 2–3 weeks, depending on how quickly the client’s team fixes the findings and prepares the system for retesting.

Combining all three sources (the Lithuanian public sector, the Lithuanian private market including the NovaTech data, and the international comparison), we arrive at the following indicative map of the Lithuanian market (all prices excluding VAT):

Mini check (1–2 working days): EUR 700–1,500. A quick web review, a check of the most important OWASP Top 10 categories and a short write-up of findings. Suitable for small and medium-sized enterprises (SMEs) and start-ups as a first look at security.
Standard web pentest (3–5 working days): EUR 1,500–6,000. One web application, authentication, authorisation, input validation, common OWASP Top 10 vectors. A full PDF report with recommendations. The typical choice for SaaS products before launch. The range is wide because the lower end reflects an independent consultant’s price and the upper end an agency offer with a broader methodology.
Extended pentest (5–15 working days): EUR 5,000–12,000. Web and API flows (OAuth, JWT), user role analysis, session management. Suitable for mature products where business logic matters.
Comprehensive package (20+ working days): EUR 15,000–40,000. Web, API, mobile application, infrastructure, sometimes social engineering. Requires a team, not a single specialist. Comparable in scope to large public sector procurements.
Enterprise / NIS2 compliance package (3–6 month contract): EUR 40,000–150,000+. Regular testing, retests after fixes, compliance documentation. Prices approach those of large public sector contracts, which require CEH, CISA/CISM and CRISC certifications and national security declarations.

These figures are indicative: an actual offer will depend on the scope (how many user roles, how many API endpoints, whether the test is black-box, grey-box or white-box), the language requirement (a report in Lithuanian or English) and additional components (retest, compliance annexes, an executive summary in Lithuanian).

What should you look at besides the price?

The lowest price is rarely the best choice. Practical signals that help you assess the quality of an offer:

Certifications. OSCP, BSCP, CREST and PenTest+ show that a specialist has a documented skill level. Big 4 firms often expect CISSP or CISA.
Methodology. The offer should clearly state PTES, OWASP WSTG or NIST SP 800-115. Without these reference points you will most likely receive a scanner report with minimal manual work.
Sample report. Ask the provider to show you an anonymised sample report. A real report contains an executive summary, technical details with a PoC, a risk rating (CVSS) and specific recommendations, not just a list of generic guidelines.
Retest included. Vulnerabilities found the first time need to be checked a second time once your team has fixed them. A good provider includes the retest in the initial price or states it clearly (for example, “retest included within 30 days of delivery”).
Chain of accountability. A signed NDA, a project manager, an escalation path in case of an incident, professional liability insurance. These are simple things, and their absence is a red flag.

We discussed how to choose a provider based on your situation and the tester’s competence rather than on price, and why it is worth rotating testers, in the article “How to choose a penetration testing company”.

Conclusions

The Lithuanian pentest market is less transparent than the Western European one: of 21 private sector providers, only a few companies publish prices on their websites (NOD Baltic — “from EUR 1,000”, Zillion Consulting — a parametric calculator starting at EUR 440), and in neither case is it clear what scope of service you can expect for the stated amount. Meanwhile, since 2024 the new viesiejipirkimai.lt portal has significantly improved public sector transparency: we found six procurements with published values that reveal the structure of the market.

The six public sector cases range from EUR 2,479 to EUR 21,780: from a single web application for Skuodas municipality (without certified specialists) to a pentest of eight information systems for the National Health Insurance Fund (with CEH, CISA/CISM and CRISC requirements for the team). In the private sector, according to NovaTech data and competitors’ market signals, the same scope costs: a small web application — EUR 1,500–4,000, several systems — EUR 5,000–12,000, a comprehensive package (the entire infrastructure) — EUR 15,000–40,000 or more.

Analysis of the three sources (public sector, private market, international comparison) converges on a single benchmark: the day rate in Lithuania is EUR 700–1,500, with a typical average of EUR 900–1,100. A typical web application pentest starts at EUR 3,000 (2–3 weeks including a retest), an extended web and API test costs EUR 5,000–12,000, and a comprehensive package EUR 15,000–40,000.

When choosing a provider, pay attention not only to the price but also to the name of the service (is it a vulnerability assessment, a penetration test or an IT audit? — in this article we saw cases where the labels are confused in both directions), the technical specification, the team’s certifications, the methodology (OWASP WSTG, PTES, NIST SP 800-115), the quality of the report and whether a retest is included. NIS2 requirements will drive up demand in 2026–2027, so prices are likely to rise. Planning your first test now often pays off — it lets you choose a provider without time pressure.

Our prices

Atakos vektorius prices for 2026 (excluding VAT, 21% in Lithuania):

The service duration is counted from the moment we receive authorisation to test and the necessary credentials or VPN access.

Tool licences: All service prices fully include work with professional commercial tools (commercial DAST, Tenable Nessus, Burp Suite Professional, etc.) — the client does not need to buy or rent any separate licences.

Vulnerability assessment

Service description	Price (EUR)	Details
Web application — based on the OWASP Top 10 methodology.	2,000	Duration: 4 days. Automated DAST with multiple roles; specialist assessment; report in Lithuanian or English with findings and recommendations.
Infrastructure perimeter: up to 60 networked devices and servers	2,500	Duration: 1 week. Commercial vulnerability scanner; specialist assessment report in Lithuanian or English with findings and recommendations.

Penetration testing

Service description	Price (EUR)	Details
A single web application according to OWASP WSTG	3,000	Duration: 2 weeks. Hybrid DAST; certified specialist; commercial tools; testing of up to three user roles; report in Lithuanian or English with PoC, CVSS; retest within 2 weeks; NDA.
Gaining access to systems in the DMZ through web application vulnerabilities, and deeper penetration through weaknesses in systems, service configuration, access control and the network layer	7,500	Duration: 1 month. Highly qualified certified specialist, commercial tools; report in Lithuanian or English with PoC, CVSS; retest within 30 days; NDA.
Gaining access to the internal network — a wider range of attack vectors, not only the web application from the DMZ but also social engineering, Wi-Fi or third-party systems (up to 60 devices)	15,000	Duration: up to 2 months. Highly qualified certified specialist and tester, commercial tools; report in Lithuanian or English with PoC, CVSS; retest within 30 days; NDA.
Gaining access to the internal network via a web application, social engineering, Wi-Fi, the DMZ or third-party systems (up to 250 devices)	20,000	Duration: up to 4 months. Highly qualified certified specialist, project manager, commercial tools; report in Lithuanian or English with PoC, CVSS; retest within 30 days; NDA.

Designing and tailoring more complex scenarios depends on the individual situation and the pricing criteria. If you are considering your organisation’s first pentest or would like an offer in line with the market average — let’s talk.