What a vulnerability assessment costs and covers

You've just received a vulnerability assessment quote, and the price makes you pause. Another consultant quoted half that amount. Before you compare the two, it helps to understand what sits behind both figures—and to ask specific questions about what each one includes.

A vulnerability assessment's cost reflects scope, methodology and thoroughness. A quote with an undefined scope, no exploitation testing, or no follow-up verification can leave gaps that become expensive problems later—regardless of its price. Understanding what drives the price helps you ask the right questions and spot where specific steps—like exploitation testing or fix verification—might have been left out.

What actually gets counted in the bill

The core of any vulnerability assessment is reconnaissance: the assessor examines your IT systems, networks, applications and sometimes physical access points to identify weaknesses. But how deep they dig varies enormously.

A basic scan uses automated tools to flag known vulnerabilities—software with unpatched versions, default passwords left unchanged, weak encryption settings. This takes hours and produces a report listing issues by severity. It's a faster, lower-cost service that suits some budgets and needs—just make sure you know exactly what's covered.

A thorough assessment goes beyond automated scanning. The assessor manually tests systems, tries to exploit weaknesses to confirm they're real, checks for misconfigurations that tools might miss, reviews access controls and interviews staff about security practices. They hunt for the specific ways your business could actually be breached, not just the textbook risks that apply to every company. This takes days or weeks depending on your environment's size and complexity.

Staffing hours form the largest cost component. A junior analyst costs less per hour than a senior consultant, but may miss sophisticated vulnerabilities or misinterpret findings. A team with domain expertise in your industry—healthcare, finance, retail—costs more but understands the particular threats you face. Whether the assessor works solo or as a team, remotely or on-site, and how much follow-up analysis they do all shift the final figure.

Scope boundaries matter heavily. Are you assessing a single application or your entire infrastructure? One office location or multiple sites? Cloud services, remote access, supply-chain connections—each addition expands the assessment surface. A quote may be priced for a narrower slice of your operations, with wider coverage listed as "out of scope"—so it's worth confirming exactly what's covered before comparing prices.

Where low quotes fall short

Comparing quotes side by side often reveals differences in what's actually included—worth checking regardless of price. Some assessments skip the exploitation phase—they identify that a vulnerability exists but don't confirm whether it's actually exploitable in your real environment. Ask directly whether this step is included. This matters because some theoretical risks are blocked by other controls you've already put in place.

Reporting quality varies sharply. A bare-minimum report lists issues with severity ratings and generic remediation steps copied from security frameworks. A comprehensive report explains how each vulnerability could realistically be exploited, what business impact it poses, which ones your organisation should prioritise, and how to fix them in your specific context. The assessor's time spent in analysis and writing shows up in pricing.

Some quotes, at any price point, omit the remediation verification phase—returning later to confirm that fixes actually worked. It's worth asking whether this step is included. This gap means you might invest in fixes that don't work, and not know it. Some providers exclude the initial scoping meeting where the assessor learns your actual environment, business priorities and risk tolerance—a step worth confirming is included, whatever you're paying. Without that conversation, they deliver a generic assessment rather than one tailored to what matters most to you.

Post-assessment support is another differentiator. Does the quote include time for the assessor to explain findings to your team, answer questions about remediation, or advise on prioritisation? Or does it end the moment the report lands in your inbox?

When comparing quotes, ask each assessor what's included in their price: the assessment methodology, who'll conduct it, how long they'll spend on-site or in your systems, what the report will contain, whether exploitation testing is included, if they'll verify fixes, and what support they'll provide after delivery. Whatever a consultant charges, they should be able to clearly articulate their methodology and what specific steps—like exploitation testing or fix verification—are included in the price.

If a provider can't clearly explain their methodology, name the tools they use, or confirm whether manual testing and exploitation are included, that's worth probing further—regardless of the price quoted. If exploitation testing, manual review and prioritisation guidance are left out of the scope, you'll get a list of issues but less insight into real risk or how to act on it—so confirm upfront what's included. Finding a verified vulnerability assessment consultant on Strove who can clearly explain their methodology and what's included at their price point helps you hire someone thorough, whatever your budget.