Answer · Updated August 2026
How much does penetration testing cost for a law firm?
Direct answer
In 2026, a one-time manual penetration test for a small or midsize law firm typically costs $4,000–$25,000 depending on scope. Continuous testing platforms cost far less: Attorney Armor starts at $199/month for automated assessment and monitoring, $499/month for weekly automated pentests across up to 10 domains, with manual red-team engagements available on Enterprise plans from $999/month.
What drives the price
Two quotes for 'a pentest' can differ by 10x because scope differs. The variables that move the number:
- Assets in scope: one brochure website versus multiple offices, client portals, and cloud tenants
- Depth: automated scanning versus manual exploitation by a human tester
- Reporting: a raw finding list versus an evidence package your insurer and clients will accept
- Retesting: whether verification of your fixes is included or billed as a new engagement
One-time engagement vs. continuous platform
The economics have shifted. A traditional consultancy delivers a point-in-time PDF that starts aging the day it arrives. A continuous platform re-tests on a schedule, monitors the attack surface around the clock, and keeps the evidence current for renewals and client questionnaires. Many firms now run continuous coverage year-round and reserve manual engagements for major changes or deep application testing.
Attorney Armor pricing
Transparent, published pricing with no per-asset surprises:
- Practice — $199/mo: 1 firm website, monthly assessments, email findings and reports, compliance checklist
- Firm — $499/mo: 10 domains plus subdomains, weekly automated pentests, attack-surface monitoring, cyber-insurance readiness package, branded reports
- Enterprise — custom, starting at $999/mo: unlimited assets, manual red-team engagements, dedicated security advisor, SAML SSO + SCIM
Related questions
Is a cheap automated scan enough for our cyber insurance renewal?
Usually not by itself. Carriers increasingly distinguish between a vulnerability scan and a penetration test. Continuous platforms close that gap by combining scheduled testing with monitoring and producing the evidence packages questionnaires ask for.
Why are manual engagements so much more expensive?
You are paying for senior human testers' time — typically days to weeks of manual exploitation, chaining, and reporting. That depth is worth it for custom applications and major changes; it is overkill as the only line of defense for a standard firm perimeter.
What should be included in the price?
Written scoping and authorization, an executive summary a non-technical partner can read, technical findings with reproduction steps, remediation guidance, and a retest of fixed findings. If retesting costs extra, budget for it.