It of course depends a lot on the scope of testing you want done (code audit, probing your running SaaS, some light breaking & entering [1]…) and how much time

It of course depends a lot on the scope of testing you want done (code audit, probing your running SaaS, some light breaking & entering [1]…) and how much time you want to give them to probe. And how well organized you are in providing them info/how much trouble it seems like you're going to be for them. And how well known the vendor doing the work is. And lots of other factors. Possibly somewhat discounted for OSS or high-profile projects, this is also an advertisement for Cure53 to some degree. But as a random guess for a random project, at least low 5-figures. [1]: https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te...