Source register
Follow the evidence.
Primary documents behind this edition. Accessed November 14, 2026; public web extractions may be cached.
Cobalt: Pentest pricing and package terms
Vendor pricing page
Tier table shows six/twelve-month retest periods; FAQ references contract term. Package clarification remains required. No market price range inferred.
Used in: Is retesting included in a penetration test?, How do you compare SaaS penetration testing costs?
HackerOne: Manage Pentest Retesting
Vendor documentation
Typical remediation period 30 or 90 days depending on pentest; unlimited retests at no extra charge within that period.
NetSPI: Penetration testing services
Vendor service page
Lists application testing for web, API and mobile among service areas; pricing, staffing and retesting terms not verified.
Used in: How do you choose a penetration testing company for SaaS?
NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (2008)
Foundational public-agency guidance, 2008
Sections 4.3 and 5.2 distinguish vulnerability scanning and penetration testing. Planning, reporting and rules of engagement are covered. Not a current compliance mandate.
Used in: Penetration test vs vulnerability scan: which do you need?, What should you ask for in a penetration test report?
OWASP: Web Security Testing Guide
Open technical guide
Versioned web security testing resource; specify a version and scoped coverage rather than vague compliance with OWASP.
Used in: What should a web application pentest scope include?