Well, the third pentester was a shadow, which is a wildcard in terms of value and probably wasn't an influence during the initial sales negotiations. Ballpark

Well, the third pentester was a shadow, which is a wildcard in terms of value and probably wasn't an influence during the initial sales negotiations. Ballpark $40,000; maybe more because there were three consultants, not two. In this case it was a cryptographic review, so it's probably closer to $80k. I forgot to take that into account in my other comment. $40k would be a pretty standard price point for a regular pentest. NCC also incurs additional risk to their reputation when organizations publish documents like this, so another $20k might've been necessary to get them to this point. I'm not positive it works that way, but I know that publishing a document like this is generally more significant than the usual "here's a secret document" deliverable. There have only been 17 public reports in total, for example: https://www.nccgroup.trust/us/our-research/?research=Public+Reports https://www.nccgroup.trust/us/our-research/?research=Public+... So it's a bigger deal on both sides of the table. I think your $100k figure is pretty on-point. Or at least not unrealistic to be closing in on that.