TL;DR
Web / API pentest: R$ 18.000 – R$ 60.000
Mobile pentest (iOS/Android): R$ 25.000 – R$ 75.000
External / Internal network: R$ 15.000 – R$ 90.000
Cloud / Kubernetes: R$ 35.000 – R$ 120.000
Red Team exercise (30 days): R$ 90.000 – R$ 250.000+
Hour-based rate: R$ 400–600/h for senior consultancies in Brazil; US$ 100–300/h for international senior pentesters.
7 variables that change the final value
1. Scope size
Number of endpoints, roles, microservices and integrations. A SaaS with 3 profiles and 80 endpoints takes 5× more than a landing page.
2. Testing approach
Black-box (external view only) is cheaper; gray-box (with credentials) is the most common; white-box (code + architecture) is the most complete.
3. Technology stack
Microservices, Kubernetes, serverless and cloud-native architectures require specialists and extend timelines by 20–40%.
4. Compliance requirements
Pentest for PCI-DSS, LGPD, ISO 27001 or SOC 2 has specific report templates, evidence and traceability.
5. Included retest
A proposal without retest is incomplete. Standard at Evernow: 1 retest after fixes, within 60 days.
6. Urgency / availability
Express starts (5-day lead time) and off-hours testing carry a 15–30% premium.
7. Seniority of testers
OSCP, OSWE, GPEN, GWAPT certifications and CVE track record justify a higher hourly rate — and a report 3× more actionable.
Frequent questions about pentest pricing
Why are there cheap R$ 3,000 pentest offers on the market?
They are automated scans rebranded as pentest. A pure DAST/VA run does not validate exploitability, chained attacks or business logic — and is rejected in PCI-DSS and serious ISO 27001 audits.
Do I need a pentest for LGPD?
LGPD does not mandate pentest explicitly, but it requires "adequate technical measures" (Art. 46). Pentest is the de-facto standard to evidence due diligence to ANPD.
How often should I run a pentest?
Minimum: annual. Recommended: every major release and once a year for baseline. PCI-DSS requires one after any significant change.
What does Evernow deliver that others don't?
Report with attacker narrative, CVSS v4 scoring, 1 free retest, integration with your Jira/ClickUp and 30 minutes of executive debrief with the CISO.
