The variables that actually move the number
Almost all of the cost is tester time, so anything that adds time adds cost in a predictable way.
- Number of distinct applications or systems in scope
- Number of user roles, since each role multiplies the access control matrix
- Whether the product is multi-tenant, which adds tenant isolation testing
- Black box or credentialed, since discovery time is not free
- Whether an API specification or architecture documentation exists
- Whether a retest is included, and how many rounds
- Whether a formal report for an auditor is required, or an internal summary suffices
Why role count matters more than page count
People estimate application size by screens. Testers estimate it by the access control matrix, which is roles multiplied by resources.
An application with three screens and five roles can take longer to test properly than one with forty screens and a single role, because every role pair has to be checked against every resource. Count your roles before you ask for a quote.
How to compare two quotes
Price alone is not comparable unless the deliverables match. Ask both vendors the same four questions and the cheap quote often turns out to be a different product.
- Is the deliverable a written report with per-finding remediation, or a tool export
- Is a retest included, and is it a retest of findings or a second full test
- Does the scope include authenticated functionality, or only the unauthenticated perimeter
- Will the methodology be documented in the report, which some compliance frameworks require
The cheapest test is the one you can act on
A low quote that produces a scanner export is not cheap; it is a cost with no corresponding fix. Your engineers either ignore it or spend their time triaging false positives, and you are no safer than before.
The thing you are buying is judgment applied to output. Scope it to what you can actually remediate this quarter, and buy depth on that, rather than shallow coverage of everything.