A penetration test for a Cyprus company typically costs between €4,000 and €15,000 before VAT. Red team exercises run about €20,000 to €70,000 or more, and DORA threat-led testing costs more again. Compare quotes on what they buy: counted tester-days, manual depth, a retest, and a report your auditor or regulator will accept.
The short answer
- A penetration test in Cyprus typically costs €4,000 to €15,000 ex-VAT; red team and DORA TLPT start above €20,000.
- Quotes are day rate (often €500 to €1,000 in Cyprus) multiplied by tester-days, plus reporting and retest.
- Compare proposals on scoped days and deliverables; the cheapest quote is usually an automated scan.
Key takeaways
- A typical Cyprus penetration test costs €4,000 to €15,000 ex-VAT; red team work runs about €20,000 to €70,000 or more, and DORA TLPT costs more again.
- Price is day rate multiplied by tester-days, and tester-days depend on asset counts, roles, complexity, depth and reporting.
- A retest adds roughly 15 to 25% and is needed to evidence remediation; PCI DSS 11.4.4 requires it for exploitable findings.
- DORA requires at least yearly testing of systems supporting critical or important functions; NIS2 and GDPR require evidence that controls work; PCI DSS v4.0.1 11.4 names penetration testing explicitly.
- Very cheap quotes are usually automated scans with template reports and no retest.
How much does a penetration test cost in Cyprus?
Most single engagements for a regulated mid-sized Cyprus firm land between €4,000 and €15,000, excluding VAT. Around ten external IP addresses, or one web application with two or three user roles, sits at the bottom of that band. Internal network plus Active Directory, a multi-tenant SaaS platform, or a combined web, API and mobile scope pushes toward the top.
Treat every figure in this article as a planning band, not a price list. Cyprus providers rarely publish rates, and the ranges reflect how engagements are commonly scoped across the EU market. The single-asset bands below assume a mid-sized business and grey box access.
| Engagement | Indicative range (ex-VAT) | What pushes it higher |
|---|---|---|
| External network (up to ~10 IPs) | €2,500-€6,000 | VPN gateways, many exposed services |
| Single web application | €3,500-€9,000 | Roles, tenancy, payments, SSO |
| API (REST or GraphQL) | €3,000-€8,000 | Endpoint count, object-level authorization |
| Mobile app (iOS + Android) | €5,000-€12,000 | Backend API in scope, anti-tamper controls |
| Internal network / Active Directory | €5,000-€15,000 | Sites, domains, segmentation tests |
| Cloud configuration review | €3,000-€10,000 | Accounts, subscriptions, IAM sprawl |
| Wireless assessment | €1,500-€4,000 | Number of offices, onsite days |
| Phishing / social engineering | €2,000-€7,000 | Vishing, pretexting, campaign count |
For most regulated firms the customer-facing application carries the most risk and rewards manual depth the most. That is where web application penetration testing should take the largest share of a limited budget.
Why does a pentest cost so much more than a vulnerability scan?
A vulnerability scan is an automated tool listing known weaknesses. A penetration test is a manual, authorized attack simulation in which a tester chains those weaknesses to show business impact, such as reading another customer’s account or reaching domain admin. The price gap reflects the difference in human hours, and many cheap quotes blur the two.
| Service | What you get | Typical effort | Indicative cost (ex-VAT) | What it evidences |
|---|---|---|---|---|
| Automated scan | Tool output, little or no validation | Hours | €500-€2,000 | Hygiene; PCI DSS v4.0.1 Req. 11.3 vulnerability scans |
| Vulnerability assessment | Scan plus manual triage of false positives | 1-3 days | €1,500-€4,000 | ISO/IEC 27001:2022 Annex A 8.8 |
| Penetration test | Manual exploitation, business-logic and access-control testing | 4-15 days | €4,000-€15,000 | GDPR Art. 32, ISO 27001 A 8.29, PCI DSS 11.4, DORA Art. 25 |
| Red team | Objective-driven, stealthy, tests detection and response | 4-8 weeks | €20,000-€70,000+ | SOC and incident response maturity |
| DORA TLPT | TIBER-EU style test with threat intelligence and regulator oversight | Several months | Above red team pricing | DORA Art. 26 for designated entities |
That is why a €1,500 “full penetration test” usually means a scanner, a template report, no authenticated multi-role testing, no business-logic work and no retest. Red flags in a proposal:
- No tester-day estimate, or one or two days for an entire application
- “Unlimited scope” at a fixed low price
- A sample report that is mostly scanner output with CVSS scores and no business context
- No named testers or certifications
- Retest, debrief or attestation listed as “optional”
You can lower cost without lowering assurance. Retire unused hosts before scoping, supply credentials and architecture notes so testers work grey box, test on a staging environment that mirrors production, bundle external, web and API work into one engagement, and agree a multi-year schedule at a fixed day rate.
What drives penetration testing cost in Cyprus?
Seven factors set almost every quote, and each one converts into tester-days.
- Scope in countable units. IP addresses and hostnames, distinct applications, user roles, API endpoints or microservices, mobile platforms, and environments. “One web app” means nothing without these numbers.
- Complexity. SSO and MFA, multi-tenancy, payment and withdrawal flows, file upload pipelines, cryptographic key handling, third-party integrations, thick clients, and OT or vessel satellite links all add days.
- Depth and access. Black box testing spends days on reconnaissance. Grey box, where you supply credentials and architecture notes, usually finds more in fewer days and is the better value.
- Timing and location. After-hours windows, production-only testing and onsite work raise cost.
- Compliance-grade reporting. Mapping findings to DORA, PCI DSS or ISO controls, an attestation letter, an evidence pack and a debrief each take time.
- Retest. Usually priced separately, and frequently omitted.
- Tester seniority. OSCP, OSWE or CREST-certified seniors cost more per day but waste fewer days and catch logic flaws juniors miss.
Sector shapes scope, too. An EMI licensed by the Central Bank of Cyprus needs PSD2 strong customer authentication and open-banking API testing. A Limassol iGaming operator licensed in Malta or the UK must meet MGA or UKGC expectations, not only the National Betting Authority’s. A ship manager’s shore IT, port integrations and constrained VSAT links cannot be tested like an office LAN.
Remote or onsite?
Most tests run remotely, which is cheaper. External, web, API, mobile and cloud tests need no physical presence, and internal network or Active Directory testing usually runs through a VM or jump box on your network. Onsite days are justified for wireless, physical and tailgating tests, segmentation checks where remote access is impossible, and vessels in Limassol port.
Does the provider’s location matter?
Less than seniority, method and contract terms. A Cyprus-based team avoids travel costs on onsite days and can pause a production test fast. Providers from Greece or other EU states deliver remote work just as well. For testers in the UK, Israel or elsewhere outside the EU, confirm the GDPR transfer basis before they handle personal data.
How do day rates and tester-days turn into a quote?
Almost every provider prices as day rate multiplied by estimated effort, plus fixed items such as reporting, retest and travel. Independent EU day rates generally sit between €600 and €1,500; Cyprus quotes are often at the lower end, roughly €500 to €1,000. A medium-complexity application usually needs 3 to 8 testing days, plus 1 to 3 days for reporting and quality review.
Three worked examples at an assumed €800 day rate:
- Customer portal, three roles, grey box: 6 testing days + 2 reporting days = €6,400. A 1.5-day retest adds €1,200. Total: €7,600 ex-VAT.
- Internal network and Active Directory, 150 users, remote via jump box: 8 testing days + 2 reporting days = €8,000, plus a €1,500 retest.
- EMI bundle: 2 days for the 10 external IPs + 6 for the web banking app + 4 for the REST API, plus 3 reporting days = 15 days, or €12,000 before retest.
Ask every bidder for this breakdown. A quote that will not state days is hard to compare and hard to defend to an auditor.
How to compare quotes like-for-like
Send every bidder the same written scope, get at least three proposals, and check each against this list:
- Asset counts, roles and environments stated explicitly
- Testing days and reporting days listed separately
- Access model (black, grey or white box) stated
- Retest included, or priced separately
- A sample redacted report and named testers with certifications
- Professional indemnity insurance limits
- NDA and a GDPR Article 28 data-processing agreement if testers will see personal data
- DORA Article 30 contractual clauses for financial entities
- Fixed price or time-and-materials, and who carries the risk if scope grows
Is VAT included, and does the reverse charge apply?
Compare all quotes ex-VAT. Cyprus standard VAT is 19%. When a provider established in another EU member state invoices a Cyprus business, the reverse charge applies and you account for the VAT yourself. That shifts the accounting; it does not cut the cost.
Financial firms with exempt supplies may not recover all input VAT, so the 19% can be a real cost whichever provider you choose.
Is penetration testing mandatory under NIS2, DORA or CySEC?
DORA comes closest to a direct mandate for penetration testing. NIS2 and GDPR require you to test whether controls work without naming a specific test. PCI DSS names one explicitly.
- DORA, Regulation (EU) 2022/2554: applies since 17 January 2025 to EU financial entities, including Cyprus investment firms, EMIs, payment institutions and crypto-asset service providers. Article 24 requires a testing programme, with tests at least yearly on ICT systems supporting critical or important functions. Article 25 lists penetration testing among those tests; Article 26 adds TLPT for designated entities.
- NIS2, Directive (EU) 2022/2555: Article 21(2)(f) requires policies to assess the effectiveness of cybersecurity risk-management measures, and penetration testing is the evidence auditors most often accept. In Cyprus, the Digital Security Authority (DSA) is the competent authority for network and information security.
- GDPR Article 32(1)(d): regular testing and evaluation of security measures.
- ISO/IEC 27001:2022: Annex A 8.8 (technical vulnerabilities) and 8.29 (security testing in development and acceptance).
- PCI DSS v4.0.1: Requirements 11.4.2 and 11.4.3 call for internal and external penetration testing at least every 12 months and after significant change. Requirement 11.4.5 covers segmentation testing, which service providers must repeat every six months under 11.4.6.
CySEC applies DORA to the financial entities it supervises; check your licence-specific circulars for additional testing expectations. For a fuller breakdown, see what Cyprus financial firms need to test under DORA, NIS2 and CySEC, or our NIS2 penetration testing in Cyprus service.
How often? At least annually, and again after significant changes such as a new payment flow, cloud migration or merger. Plan the whole cycle: one to two weeks of scoping, one to three weeks of testing, a week of reporting, and a retest six to twelve weeks later.
How much does a red team or DORA TLPT cost?
A red team exercise typically costs €20,000 to €70,000 or more. A DORA TLPT usually costs more because it follows TIBER-EU, adds a separate threat intelligence phase and runs under regulator oversight. The active red team phase alone lasts weeks rather than days.
TLPT is not an upgraded annual pentest. It is required, at least every three years, only for financial entities their competent authority identifies under Article 26. It targets live production systems behind critical functions, and testers must meet the requirements of Article 27. Cost drivers include the threat intelligence provider, a long testing window, the internal control team’s time, purple-team replay and regulator attestation.
If you have not been designated, you do not need TLPT. If designation is likely, a well-scoped red team or DORA threat-led penetration testing (TLPT) readiness exercise is a sensible first step.
What should the retest and report cover, and what is not included?
A retest usually costs extra: typically 15 to 25% of the original fee, or about €750 to €2,500 for a light verification. It is also the line item most often missing from cheap quotes. Auditors need it: PCI DSS 11.4.4 requires exploitable findings to be corrected and retested, and DORA and ISO auditors want proof of remediation, not just a list of findings.
A report that will hold up with an auditor, CySEC, the Central Bank of Cyprus or the Digital Security Authority should include:
- An executive summary written for the board
- Scope, dates, methodology (OWASP WSTG, PTES or NIST SP 800-115) and named testers
- Each finding with reproduction steps, evidence, and a CVSS v3.1 or v4.0 score plus a business-impact rating
- Specific remediation guidance
- An attestation or letter of completion
- A retest report showing the closed status of each finding
The fee does not cover fixing what testers find. Remediation needs developer and admin time, or a separate budget. A clean report is a point-in-time sample, not a guarantee, and outsourcing the test does not outsource accountability: under NIS2 and DORA, the management body still owns the risk.
FAQ
How much does a penetration test cost in Cyprus?
Most engagements cost between €4,000 and €15,000 before VAT. A small external network or a single web app sits at the low end; internal Active Directory, multi-app or red team work costs more.
What is a typical pentest day rate in Cyprus?
Cyprus quotes often fall between about €500 and €1,000 per tester-day, while wider EU rates range from about €600 to €1,500. Senior, certified testers sit at the upper end.
Is a vulnerability scan enough for NIS2 or DORA?
Usually not. A scan lists known weaknesses but does not show exploitability or business impact, and DORA Article 25 names penetration testing among the tests financial entities should run.
How much does a penetration test retest cost?
Expect about 15 to 25% of the original fee, or roughly €750 to €2,500 for a light retest. Confirm whether it is included before signing.
Is VAT included in Cyprus penetration testing quotes?
Compare quotes ex-VAT. Cyprus standard VAT is 19%. A provider established in another EU state invoices under the reverse charge, so you account for the VAT yourself; firms with exempt supplies may not recover all of it.
Should I choose a Cyprus-based provider or one from abroad?
Seniority, method and contract terms matter more than location. A Cyprus team saves travel on onsite days; EU providers handle remote work equally well. For testers outside the EU, confirm the GDPR transfer basis first.
If you want a quote broken down by scope, tester-days and deliverables that maps to your regulator’s expectations, start with our compliance and regulatory readiness team.