It is one of the first questions every organisation asks, and one of the hardest to find a straight answer to. Most security firms in Rwanda and across East Africa do not publish pricing, and for good reason: every engagement is different.
This guide explains what drives penetration testing costs, what you should expect from a professional assessment, and how to evaluate proposals on substance rather than price alone. For a complete overview of penetration testing in Rwanda including scope, methodology, and BNR requirements, see our full penetration testing guide.
What determines the cost?
Penetration testing is not a commodity. It is a professional service performed by skilled security testers who simulate real attacks against your systems. The price of an engagement is shaped by several factors:
| Factor | Impact on cost | Why it matters | | ---------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scope | High | A single web app is far less effort than a full assessment covering web, mobile, APIs, USSD, and internal infrastructure. More assets in scope means more testing time. | | Application complexity | High | A core banking platform with hundreds of endpoints, multiple user roles, and transaction processing takes significantly longer to test than a brochure website. | | Testing methodology | Medium | Black box (no credentials) requires more reconnaissance than grey box (credentials provided). Most engagements use grey box for the best balance of realism and coverage. | | Tester expertise | High | Experienced offensive-security testers who have worked across financial institutions deliver substantially deeper findings than junior analysts running automated tools. | | Compliance mapping | Medium | Mapping findings to BNR regulations, PCI DSS, or ISO 27001 requires additional analysis and structured reporting beyond a standard technical report. | | Deliverables | Medium | Executive summaries, remediation workshops, board-ready presentations, and retesting all add to the engagement scope and value. |
What should a professional pentest include?
Regardless of scope, a legitimate penetration test from a qualified provider should always include:
- Manual testing led by a credentialled practitioner: not just automated scanning. Tools like Nessus and Burp Suite are starting points, not the entire assessment.
- Recognised methodology: OWASP Testing Guide, PTES, OSSTMM, or NIST SP 800-115. If the provider cannot name their methodology, that is a red flag.
- Executive summary: a non-technical overview suitable for management and board reporting, with risk ratings and business impact analysis.
- Detailed technical report: every finding documented with CVSS scoring, proof-of-concept evidence, affected assets, and step-by-step remediation guidance.
- Debrief session: a walkthrough of findings with your technical team to answer questions and prioritise remediation.
- Retest: after you remediate the findings, the provider should verify the fixes are effective. The best providers include this in the engagement.
The cheapest option is rarely the best option. For BNR-regulated financial institutions, a penetration test is not a checkbox exercise. It is how you demonstrate to the regulator, and to your customers, that you take security seriously. An automated scan repackaged as a "pentest report" will not satisfy a competent regulator or protect you from a real attack.
International firms vs local providers
Many Rwandan organisations default to international providers from Europe, the US, or South Africa for their security assessments. These firms deliver quality work, but they come with significant overhead: international travel costs, higher hourly rates, and limited understanding of the local technology landscape.
A Kigali-based provider with equivalent certifications and experience can deliver methodology and reporting that hold up against international firms at a substantially lower cost. The savings come from eliminating travel expenses, lower operational overhead, and deep familiarity with the technologies common in East African financial services: USSD, mobile money platforms, and local banking infrastructure.
The key is verifying credentials. OSCP is the benchmark hands-on credential for penetration testing competence, and BNR Regulation N°50/2022 lists it among the qualifying certifications for testers serving regulated institutions. If a provider's testing is led by an OSCP-credentialled practitioner with demonstrated experience inside financial institutions, the work can hold up against larger firms regardless of where they are headquartered.
How to budget for security testing
If you are an IT manager or CISO building a security budget for your organisation in Rwanda, think about penetration testing in tiers:
Foundational programme
Annual web application and external network testing. For BNR-supervised institutions, this covers the annual penetration test that Regulation N°50/2022 requires (the regulation also mandates vulnerability assessments at least twice a year) and gives you visibility into your most exposed attack surface. Suitable for smaller institutions and fintechs with a limited number of customer-facing applications.
Recommended programme
Quarterly application testing combined with an annual full-scope assessment that includes internal network, mobile apps, and API testing. This provides continuous visibility and catches new vulnerabilities introduced by development cycles. Suitable for mid-size banks, MFIs, and telecoms.
Enterprise programme
Continuous testing integrated into your development pipeline, managed vulnerability tracking, quarterly assessments across all assets, and periodic red team exercises. This is the standard for large banks and organisations with complex, constantly evolving environments.
The right programme depends on your organisation's size, regulatory obligations, and risk appetite. A qualified provider will help you determine the appropriate scope during a scoping consultation, before any commitment.
Consider the alternative. IBM's Cost of a Data Breach Report 2024 puts the global average at USD 4.88 million per incident, and the financial-industry average higher still, at USD 6.08 million. The cost of regular security testing is a fraction of what a single breach would cost your organisation in financial losses, regulatory penalties, and reputational damage.
Red flags when evaluating proposals
Watch out for these warning signs when comparing penetration testing providers:
- Extremely low pricing: if a quote seems too good to be true, you are almost certainly getting an automated scan report, not a manual security assessment. Real penetration testing requires skilled consultants and time.
- Pricing per vulnerability: this creates perverse incentives to inflate findings or miss them entirely. Professional engagements are scoped by time and assets, not by findings count.
- No methodology referenced: legitimate providers reference OWASP, PTES, or OSSTMM. If they cannot explain their testing approach, question the depth of the assessment.
- No sample report available: if they cannot show you what the deliverable looks like, be cautious about what you will actually receive.
- No recognised certifications: OSCP, PNPT, CREST, or equivalent hands-on certifications demonstrate that the tester can actually find and exploit vulnerabilities, not just run tools.
- No retest included: finding vulnerabilities is only half the job. Verifying that fixes work is equally important. Providers who do not offer retesting are leaving the job unfinished.
Getting a quote
To get an accurate, tailored quote from any provider, prepare the following information:
- What systems need testing (web apps, APIs, mobile apps, network, USSD, cloud)
- Number of applications and approximate number of pages or endpoints
- Number of user roles per application
- Whether credentials will be provided (grey box vs black box)
- Any compliance requirements (BNR, PCI DSS, ISO 27001)
- Preferred testing window and any blackout periods
- Whether retesting is required after remediation
A qualified provider will review this information and come back with a detailed proposal including scope, methodology, timeline, and fixed pricing, typically within 48 hours.
For more on what VAPT involves and how to choose a provider, read our complete penetration testing guide for Rwanda. If your main driver is BNR compliance, our BNR cybersecurity requirements guide explains exactly what regulators expect.
How we can help
IMIZI Cyber is a penetration testing firm based in Kigali, working with banks, fintechs, telecoms, government bodies, healthcare providers, and other regulated institutions across Africa. We price engagements as fixed-price proposals with no hidden costs: every proposal sets out scope, methodology, timeline, deliverables, and a re-test of critical and high findings at no extra charge. Our reporting is built for BNR-aligned engagements and written to be acted on, not filed.
For details on what our engagements include, see our penetration testing service page. For broader security assessment needs, see our security assessments service page. Book a Free Call, share your scope details, and we will send a tailored fixed-price proposal within 48 hours.