Cost Estimates, Worked Examples and Best-Fit Checklists
Penetration testing cost in Canada, and the written authorisation every test needs
Pen-test pricing by scope for Canadian SMEs, illustrative fees, and why Criminal Code s. 342.1 makes written authorisation essential.
A penetration test is an authorised, simulated attack on a defined part of your systems to find weaknesses before criminals do. It is usually priced as a fixed fee per engagement, driven by scope: how many external IP addresses, internal network segments, web applications, user roles or cloud accounts are tested, whether social engineering is included, and whether a retest is part of the price. Illustratively, a small external test may cost a few thousand dollars and a combined internal, external and application test tens of thousands. Just as important as price is authorisation: under the Criminal Code, obtaining computer services or intercepting functions of a computer system fraudulently and without colour of right is an offence (s. 342.1), so a test must be done under written permission from someone entitled to give it, with agreed scope, dates and methods.
This guide is part of how to choose a managed security provider. Fees are illustrative; this is not legal advice.
Types of tests and what drives the fee
| Test type | What is tested | Main price drivers | Illustrative fee (CAD, before tax) |
|---|---|---|---|
| External network | Internet-facing IP addresses, VPN, email gateways | Number of live hosts and services | $5,000–$15,000 |
| Internal network | What an attacker on a staff laptop could reach | Network size, segments, Active Directory complexity | $10,000–$30,000 |
| Web application | A customer portal or online store | Number of pages, roles, APIs, authentication | $8,000–$35,000 |
| Cloud configuration | Microsoft 365, Azure, AWS or Google Cloud settings | Number of tenants, subscriptions, accounts | $6,000–$25,000 |
| Social engineering | Phishing or phone pretexting against staff | Number of staff, scenarios | $3,000–$12,000 |
| Wireless / physical | Office Wi-Fi, building entry | Sites, travel | $3,000–$15,000 per site |
| Retest | Confirm fixes | Number of findings | Often included, or a fraction of the original |
A vulnerability scan is not a penetration test. Scans are automated and often sold monthly as part of a managed service. A pen test involves people trying to chain weaknesses together.
Worked example (illustrative)
A 35-person Victoria travel company runs a booking portal and Microsoft 365. Its insurer and a corporate client both ask for an annual test.
| Item | Scope | Fee |
|---|---|---|
| External network | 8 public IP addresses | $6,500 |
| Web application | Portal with 2 user roles and an API | $14,000 |
| Microsoft 365 configuration review | 1 tenant | $5,500 |
| Retest | Included | $0 |
| Total before tax | $26,000 | |
| GST 5% | British Columbia | $1,300 |
Ask the provider and your accountant whether BC PST applies to any part of the invoice, for example software or tools supplied with the test. Spread over 12 months in the cost estimator, the test adds about $2,167 a month to the security budget.
Authorisation: why it matters and who can give it
Section 342.1 of the Criminal Code makes it an offence to fraudulently and without colour of right obtain computer services, intercept a function of a computer system, or use a computer system with intent to commit certain offences, with a maximum of 10 years' imprisonment on indictment. Section 430(1.1) separately covers mischief in relation to computer data. A legitimate tester relies on clear, written authorisation from a person entitled to give it. Practical rules:
- Authority. The signatory must have authority over the systems tested, usually an officer of the business.
- Third-party systems. Cloud platforms, hosting companies, your MSSP and SaaS vendors own their infrastructure. Check their testing policies; some require notice or forbid certain tests. You cannot authorise testing of a system you do not control.
- Scope. List IP ranges, domains, applications and accounts in scope, and anything explicitly out of scope.
- Dates and times. Testing windows, blackout periods and time zone.
- Methods. Whether denial-of-service, social engineering, physical entry or exploitation of production data is allowed.
- Contacts. Who to call if the test causes an outage or finds evidence of a real intrusion.
- Data handling. How any personal information encountered is protected, stored and destroyed.
Tell your managed security provider about the test so it does not treat the testers as an attack, or agree to keep it secret to test detection, with a named person who can confirm the test if alarms go off.
Rules of engagement checklist
- Signed authorisation letter from an authorised officer.
- Scope document with assets in and out of scope.
- Confirmation of permission from hosting and cloud providers where their policies require it.
- Test window and emergency stop procedure.
- Named contacts on both sides, with phone numbers.
- Handling of personal information and evidence of real compromise.
- Report format, severity ratings and delivery date.
- Retest terms.
- Confidentiality and professional liability insurance of the testing firm.
Add these to the due-diligence checklist.
Reading the report and paying for fixes
A useful report ranks findings by risk to your business, explains how each was found, and gives a practical fix. Budget for remediation: patching, configuration changes or development work can cost more than the test. Ask your vCISO or MSSP to turn findings into a dated plan; see vCISO pricing and SLA questions.
Frequently asked questions
How often should we test?
Many businesses test once a year and after major changes such as a new portal or network. Clients, insurers or standards may set the frequency.
Is a cheaper test a worse test?
Not necessarily. Compare scope, tester time in days, methods and retest terms rather than the total alone.
Should my MSSP test its own work?
An independent tester gives a more credible result for clients and insurers.
Can an employee test our systems?
An employee authorised in writing for a defined scope can, but the same care with scope and third-party systems applies.
Sources
- Justice Laws Website — Criminal Code ss. 342.1 and 430(1.1)
- Canadian Centre for Cyber Security — guidance on vulnerability management and testing
- Office of the Privacy Commissioner of Canada — protecting personal information handled by contractors
- Canada Revenue Agency — GST/HST on services
