Key Takeaways
- A retest checks that the findings from your original report were actually fixed. It is not a second full penetration test, and many vendors say so explicitly.
- Vendors bundle pentest retesting in at least four ways: included in the base price, included for a subscription term, included with limits on severity or time, or quoted separately after the findings are reviewed.
- Two quotes that look similar can differ by a few thousand dollars once retesting terms are read closely, so compare the terms and not only the headline price.
- Ask how many retest rounds are included, how long you have to request one, which findings it covers, and whether your report and attestation letter are updated afterward.
If you are comparing pentest quotes, you have probably noticed that retesting is described differently by every vendor. Some say it is free, some say it is separate, and some say it depends. Pentest retesting matters because it is what turns a list of findings into evidence that those findings were closed. Here is what a retest covers, how vendors tend to bundle it, and what to ask before you sign.
What a Retest Actually Is
After the main test, your team fixes the issues in the report. A retest is the follow up where the testers confirm those fixes work. It usually covers the findings that were reported, either all of them or a chosen subset, and produces an updated report or a short validation summary.
It is narrower than the original test. Software Secured’s public documentation, for example, says its retests do not look for new vulnerabilities unless they arise directly from the remediation itself. That is a normal boundary, and it is worth knowing so you do not assume a retest is a fresh look at the whole application.
Four Ways Vendors Bundle Pentest Retesting
Most quotes fall into one of these patterns:
- Included in the base price. The fee covers the test and a set number of retest rounds. Check the limits.
- Included for a subscription term. Common with platform based models, where retesting is available throughout the contract period.
- Included with limits. Free, but restricted by severity, asset type, or a request window.
- Quoted separately. The retest is priced after the findings are known, so the price reflects how much needs to be verified.
None of these is automatically better. What matters is that you know which one you are buying before the SOW is signed.
Comparing quotes and unsure how retesting is treated in each? Book a scoping call and we will walk through how retesting would work for your scope.
How Some Vendors Describe Their Retest Terms
The examples below come from each vendor’s own public pages and show how different the terms can be. Terms change and can differ by plan, so confirm current terms directly with any vendor you are considering.
- Cobalt. Its pricing page lists free retesting and says its platform model provides unlimited on demand retesting throughout the contract term. Credits are sold in annual packages that include retesting, and credits expire each contract year.
- Software Secured. Its documentation describes one round of retesting for its Standard offering, three rounds for Standard Plus, and unlimited rounds for PTaaS and Premium clients, subject to schedule availability. It says retests are typically supported within two weeks of a request and that further retesting may be available for an additional fee.
- Blackfoot UK. Its page says critical and high findings on internet facing assets are retested at no extra cost, and that you must request the retest within two calendar months of the report being released.
- Packet33. Retesting is quoted separately once we have reviewed the findings, and it is scoped to the issues you fixed.
Accurate as of November 2026, based on each vendor’s public documentation. Terms vary by plan and change over time, so confirm directly with each vendor.
The pattern is clear. One vendor offers unlimited retesting as part of a subscription, one limits rounds by tier, one limits by severity and time, and one prices it after the findings. All are legitimate, and they suit different needs.
What to Ask About Retesting Before You Sign
- Is a retest included, or priced separately? Ask for it in writing in the quote or SOW.
- How many rounds are included? One round may not be enough if some fixes fail the first time.
- How long do I have to request it? Some windows are measured in weeks or months and then close.
- Which findings does it cover? All findings, only critical and high, or only those in the original scope.
- Will it look for new issues? Usually not, so ask what happens if a fix introduces a new problem.
- Is the report updated? You want a document or attestation letter that shows the remediated state, not only the original findings.
- Will the same testers do it? Continuity saves time and avoids re explaining the application.
- Which environment is used? Confirm whether the retest runs in the same environment and with the same accounts.
If you want a broader list of questions to compare vendors, our pentest vendor evaluation guide covers hours, methodology, and sample reports.
Why the Retest Matters to Auditors and Buyers
A report full of open findings tells a reviewer what was wrong. A retested report tells them it was fixed. That difference matters when an auditor, an enterprise customer, or a partner reads your evidence. NIST SP 800-115 describes technical security testing as a planned, documented process, and a retest is how that record shows the issues were closed.
It also affects timing. If you are working back from an audit date or a launch, build in time for testing, fixes, and the retest. A report that arrives the week before the deadline leaves no room to fix and verify anything. Requesting any attestation letter after the retest, not before, means it reflects your current state.
How We Handle Retesting
We quote retesting separately, after we have reviewed the findings. A report with a handful of findings needs far less verification than one with dozens, and pricing it afterward means you pay for the work that is actually needed rather than a flat figure set before anyone knows the results. The retest covers the findings you fixed, and you receive an updated report that shows their status.
FAQ
Is a retest included in a pentest? It depends on the vendor and the plan. Some include one or more rounds, some include it for a subscription term, and some price it separately. Ask for the terms in writing.
How long after the report can I request a retest? Vendors set their own windows, and some close after weeks or a couple of months. Ask for the window up front and plan your remediation around it.
Does a retest find new vulnerabilities? Generally no. A retest verifies the reported fixes. A new test is a separate engagement, so ask what happens if changes introduce new issues.
Do I need a retest for SOC 2? Requirements vary by auditor, but many prefer evidence that findings were remediated and not only identified. Confirm what your auditor expects.
Can a retest change my attestation letter? It can. A letter issued after the retest can reflect the remediated state, which usually reads better to a reviewer than one listing open issues.
Should I choose a vendor mainly because retesting is free? It is one factor among several. Compare who does the testing, how deep it goes, and what the report shows. Free retesting with a shallow test is not better value.
If you are comparing quotes and want retesting terms spelled out before you commit, book a scoping call, or start with our SaaS penetration testing page for more information.
Packet33 is a penetration testing and compliance advisory firm serving SaaS and HealthTech startups in the US, Canada, and UK.
Mohamed is the founder of Packet33. He worked as a cybersecurity analyst before launching the firm and now leads an OSCP-certified team serving SaaS and HealthTech startups in the US, Canada, and UK.