I've seen a couple of the cheap pen tests by a few German companies. The whole thing looked like a 1-2 days of work and the person doing it was doing the basic

I've seen a couple of the cheap pen tests by a few German companies. The whole thing looked like a 1-2 days of work and the person doing it was doing the basic stuff, but definitely conducted by a knowledgeable person and when problems were found reasonable suggestions were offered in the report. The apps were standard - frontend in Angular, backend in Spring Boot on Tomcat. basic DoS, XSS, SQLi, token abuse, open ports with not up to date services, generic vulnerability scanner, basic password brute forcing