How Much Does a Pentest Cost in Brazil? 2026 Price Ranges

A pentest in Brazil in 2026 costs between R$ 3,000 and R$ 60,000 per one-off project, with the middle band — R$ 8,000 to R$ 18,000 — accounting for most engagements. Price moves along five axes: company size, technical scope, testing mode (black box/white box), regulatory sector and methodology depth. This article explains each one and shows how to avoid the most common traps when you request quotes. If you're budgeting a pentest for an operation in Brazil or comparing Brazilian providers, these are the local market numbers, in Brazilian reais (R$).

Executive summary

These are Brazilian market prices for engagements with Brazilian companies. No Vuln prices international engagements separately, in USD, by hour package: Sprint (25h): US$ 3,750 to US$ 6,250; Deep Dive (50h): US$ 7,500 to US$ 12,500; Full Scope (100h+): from US$ 15,000. PTaaS is priced on request.

The 5 factors that move the price the most

1. Application size (number of endpoints and screens)

Endpoint count is the main technical price driver. A serious pentest maps every endpoint against every role × every HTTP verb. That's linear work:

• Up to 50 endpoints — ~5 business days of actual work
• 50 to 200 endpoints — ~10 business days
• 200 to 500 endpoints — ~15 business days
• 500+ endpoints — requires a focused scope; you can't cover everything equally

2. Testing mode: black box, white box or grey box

A black-box pentest is cheaper because the researcher does reconnaissance like an outside attacker. White box costs more because the researcher reads your code, your infrastructure and your documentation — finding more bugs, but taking longer.

• Black box — base price, ~70% of possible coverage
• Grey box — +15% over black box, ~85% coverage
• White box — +30% to +50% over black box, ~95% coverage

3. Regulatory sector

Regulated sectors pay more — not out of greed, but because of real additional work. Each regulation has its own checklist, report type and depth requirements:

• Fintech (BACEN Resolution 4,893 (CMN 4,893)) — Brazil's Central Bank cybersecurity rule. Requires coverage of Pix (Brazil's instant payment system), KYC, Open Finance and payment flows. ~+50% over an equivalent non-financial pentest.
• Healthcare (LGPD + sensitive data) — under the LGPD, Brazil's data protection law, it requires extra care with PII and severity calibrated to LGPD impact. ~+20%.
• SOC 2 / ISO 27001 — requires a report formatted for the audit. ~+15% (documentation overhead).
• PCI DSS 4.0 — requires a documented methodology (req. 11.4.1) and specific cardholder data environment coverage. ~+30%.

4. Methodology depth

This is the most opaque axis — and the one that most separates a serious pentest from security theater. There are three levels of depth on the market:

• Level 1 — scanner plus a PDF: they run Nessus/Acunetix and format the output into a pretty report. Coverage: obvious bugs. Price: R$ 1,500 to R$ 5,000. Anyone offering this as a “pentest” is just selling you a scanner.
• Level 2 — scanner + manual review: they run a scanner, then a junior analyst reviews the findings and tries simple combinations. Coverage: a surface-level pass over the OWASP Top 10. Price: R$ 5,000 to R$ 12,000. Most of Brazil's traditional market.
• Level 3 — human adversarial research: experienced bug bounty researchers attack business logic, exploit chains and flawed assumptions. Coverage: the vulnerability classes that matter in 2026 (at No Vuln, 86 attack vectors and 1,017 sub-vectors mapped). Price: R$ 10,000 to R$ 60,000. This is what finds the bugs that actually take companies down.

The difference between Level 2 and Level 3 doesn't show up in the quote — it shows up in the report. Business logic bugs, race conditions, cross-tenant BOLA, OAuth state confusion: they only surface at Level 3.

5. An assigned researcher vs. “the team”

Some consultancies charge a premium by pointing to a “team of 6 researchers.” In practice, the real work is done by 1 or 2 experienced researchers — the rest are juniors writing documentation. Always ask: “who specifically is going to attack my system?”

Common quoting traps

Trap 1: retest billed separately

You pay R$ 8,000 for the pentest, get 12 findings, fix everything, and the consultancy charges another R$ 4,000 to validate the fixes. It's an old practice that's still common in Brazil. A serious pentest in 2026 includes the retest in the initial price, within 30 to 90 days after the fix. Always ask explicitly.

Trap 2: “all systems” in scope for R$ 5,000

If a proposal covers “web + APIs + mobile + cloud + infra” for R$ 5,000, either the consultancy is deliberately losing money to close the deal (and will deliver something superficial), or it's running a scanner on everything. An in-depth pentest of 5 attack surfaces takes one researcher at least 5 weeks. The back-of-the-napkin math doesn't add up.

Trap 3: a report whose PoC is a scanner screenshot

A reproducible PoC means: the full HTTP request + payload + response + steps to reproduce. If the report only has an Acunetix screenshot flagging “XSS,” without the exact payload, that's not a PoC. It's marketing.

Trap 4: severity based on technical CVSS alone

On its own, CVSS 3.1 gives a 9.8 to an XSS in an “About me” field nobody uses, and a 5.0 to a BOLA on a payment endpoint. A modern pentest uses CVSS 4.0 + business impact, calibrated to the client's scope.

Trap 5: “100% automated pentesting”

It doesn't exist. Automation covers 30 to 40% of the work — discovery, basic scanning, replay. The rest is manual. Anyone promising 100% automation is selling a scanner with a fancy name.

How to get a fair quote

The rule of thumb that works:

1. Map your scope: number of endpoints, desired testing mode, applicable regulations
2. Get 3 proposals — one from each price tier (Level 1, Level 2, Level 3)
3. Compare report content, not price: ask each vendor for a sample report (with no real client data)
4. Check for a reproducible PoC, calibrated severity and an included retest
5. Ask explicitly: “which researcher will work on my project?” and ask for their track record (published CVEs, bug bounty halls of fame, talks)

A serious pentest is expensive because it's skilled human work. A cheap pentest is expensive because you pay and are still left with the vulnerability. The economics are simple.

Quick pricing FAQ

Can I pay in installments?

In Brazil, yes: most of the market splits one-off projects into up to 3 interest-free installments for local clients. For international clients, No Vuln invoices in USD via Wise or international wire transfer — 50% at kickoff and 50% on delivery.

Can I get a tax invoice and expense it?

In Brazil, yes. A pentest is a professional technical service, invoiced with an NF-e (Brazil's electronic invoice) and deductible as an operating expense (IT/security). Outside Brazil, No Vuln issues a USD invoice; check the tax treatment in your country with your accountant.

How much does a researcher cost per hour?

In the Brazilian market in 2026, a senior bug bounty researcher's rate runs between R$ 350 and R$ 800 per hour. The best charge more — because they deliver more. For reference, No Vuln's rate for international clients is US$ 150 to US$ 250 per hour, depending on stack, testing mode and timeline.

Is ongoing monthly testing worth it?

Yes, for growing SaaS companies, fintechs and e-commerce businesses that ship code every sprint. An annual one-off pentest leaves 11-month windows without coverage. Ongoing testing covers the delta of every release. In the Brazilian market, its price varies — monthly or quarterly hour bank, depending on scope; No Vuln's PTaaS for international clients is priced on request.

Conclusion

A pentest in Brazil in 2026 runs from R$ 3,000 to R$ 60,000+. You're not paying for the “PDF” — you're paying for who attacks your system. A junior researcher running a scanner costs little and delivers little. A senior researcher doing real adversarial analysis costs more and finds the bugs that actually matter.

Before signing a proposal, ask for a sample report, check for a reproducible PoC, confirm the retest is included, and ask which specific researcher will work on your project. That filters out 70% of the market in 5 minutes.