In Canada, a penetration test generally costs between $3,000 and $25,000, depending on scope. An automated vulnerability scan costs much less, between $500 and $2,000, but it is not a real penetration test.
At UpSystems, we publish our prices:
| Service | Price | What you get | Who it is for |
|---|---|---|---|
| Automated vulnerability scan (external) | $500 to $1,500 | Automated tools, list of known vulnerabilities ranked by severity, recommendations. No exploitation. | SMBs that want a first snapshot of their exposure, or a check between two tests |
| Manual penetration test | from $4,000 | An expert actually tries to break into your network, internal and external, and reproduces the attack paths. Detailed report and debriefing. | SMBs that must prove their security to a client, an insurer or for Law 25 |
| Red team exercise | from $12,000 | A longer, deeper simulated attack that also tests your ability to detect the intruder and respond. | Companies that have already done a penetration test and want to check their detection |
For a single-site SMB, a manual internal and external test takes about 4 days and costs about $4,000 to $4,500. The exact price depends on the number of IP addresses, sites and the depth of the test.
Automated or manual: the real difference
An automated scan compares your systems to a list of known vulnerabilities. It tells you a door might be poorly locked.
A manual penetration test sends someone to try to open it. The expert chains several small weaknesses to reach your data, as a real attacker would. No automated tool does this chaining.
| Criterion | Automated scan | Manual penetration test |
|---|---|---|
| Who does the work | Software | A cybersecurity expert |
| Real exploitation of vulnerabilities | No | Yes |
| False positives | Frequent | Validated one by one |
| Logic and configuration flaws | Rarely detected | Actively sought |
| Accepted as proof by a client or insurer | Rarely | Yes |
| Duration | A few hours | 3 to 5 days for an SMB |
What the Canadian market charges
Firms that publish their prices in Québec and Canada fall within these ranges, in Canadian dollars:
| Type of test | Published range | Source |
|---|---|---|
| Vulnerability scan | $500 to $2,000 | Sequr (Québec) |
| External test, SMB | $3,000 to $8,000 | Sequr (Québec) |
| External test, SMB | $5,000 to $12,000 | IT Sincennes (Gatineau) |
| Internal test | $5,000 to $15,000 | Sequr (Québec) |
| Full internal + external test | $12,000 to $25,000 | Sherlock Forensics |
| Network test, Canadian SMB | $8,000 to $25,000 | Fusion Computing |
| Red team | $15,000 to $100,000 and up | Sequr (Québec) |
These firms agree on one point: a “penetration test” sold for under $1,500 to $3,000 is almost always an automated scan in a nice report. It is not a bad product, but it is not the same product.
Location changes the price very little: most penetration testing is done remotely, so the same ranges apply in Ontario and across Canada. In Québec, the extra cost comes mainly from French-language reporting and Law 25 documentation.
What drives the price
- Scope. The number of public IP addresses, sites, servers and applications to test. This is the main factor.
- Internal, external or both. An external test looks at what an attacker sees from the Internet. An internal test simulates a tricked employee or a compromised computer. Doing both costs about twice as much as external alone.
- How much information you provide. With no information (black box), the tester spends more time on reconnaissance. With some access provided (grey box), they go further for the same budget.
- Web applications. A client portal or in-house application requires extra days of testing.
- The retest. Checking that vulnerabilities were fixed is sometimes included, sometimes billed separately. Ask for it in writing.
- Compliance requirements. A report for an insurer, a demanding client or Law 25 requires more documentation.
How to spot a fake penetration test in a quote
Ask the vendor these five questions. A real penetration test answers yes to each.
- How many hours of manual work are planned, and by whom?
- Will the tester exploit the vulnerabilities found, or only list them?
- Does the report show the reproduced attack paths, with evidence?
- Is there a debriefing with the person who did the test?
- Is the retest of fixed vulnerabilities included?
If the quote only mentions a tool name (Nessus, Qualys, OpenVAS) and a PDF report, you are buying a scan. That is useful, but pay the price of a scan.
Why a manual test costs less at UpSystems
Our manual penetration test starts at $4,000, below the market average. It is not a disguised scan: an expert actually exploits the vulnerabilities, internal and external, and presents the results to you in person.
The price comes from our structure. UpSystems is an IT services company based in Laval, not a large consulting firm: no downtown office costs or layers of management. Our experts are here in Québec, and the report is written in French or English, ready for Law 25.
Example: for a Québec door and window manufacturer, we carried out a 4-day internal and external test. The client fixed the attack paths we found before a real attacker could exploit them.
Want to know where you stand? Book a 30-minute call with an expert. We will tell you whether a scan is enough or you need a real test, and give you a firm price. Learn more about our penetration testing service.
Frequently asked questions
How much does a penetration test cost for an SMB in Canada?
Between $3,000 and $25,000 depending on scope. At UpSystems, an automated scan costs $500 to $1,500, a manual internal and external test starts at $4,000 for a single-site SMB, and a red team exercise starts at $12,000.
Is a vulnerability scan a penetration test?
No. A scan lists known vulnerabilities automatically. A penetration test actually exploits them with an expert, to show what an attacker could reach.
How long does a penetration test take?
For an SMB, 3 to 5 days of testing, then a few days for the report and debriefing.
How often should you run a penetration test?
At least once a year, and after any major change: a new server, an office move, a new application exposed to the Internet.
Does a penetration test help with Law 25?
Yes. Law 25 requires reasonable security measures to protect personal information. A penetration test report documents that you have checked them.
Do we need to stop operations during the test?
No. The test is planned with you and risky actions are agreed in advance.