The cost of a penetration test primarily depends on two factors: the effort involved and the day rate.
1. The time required for a penetration test
The duration of a penetration test depends on the size and complexity of an application or an IT infrastructure. As a rule, there are no blanket estimates and it always comes down to the individual case. I consider quotes without a prior effort estimate to be fundamentally unserious and would advise against them.
The rough direction, though, is as follows: for a small web application - a double-digit number of pages with a few forms and parameters - you end up at roughly one day, including the preliminary discussion, the actual pentest and the report writing. For web applications, the effort then grows less with the number of links than with rising complexity: session management, role and user management, AJAX etc. can quickly drive up the necessary effort.
Specifying the effort of an IT infrastructure penetration test as a blanket figure is even harder. It depends on the actual goal, the number of hosts, the applications and services. Sometimes it makes more sense to define the actual objectives of the test first and then budget a fixed number of days for them.
2. The day rate of the penetration tester
The day rate in penetration testing likewise depends on various factors: for example, the experience and qualifications of the penetration tester, the size of the associated company, the company location, sales targets etc.
If you are looking for a qualified freelance pentester, you quickly end up at day rates of €800 and up. All example prices here, drawn from my experience, would be net figures for companies. If you commission a company with a handful of employees for a pentest, you start out somewhere around €1,000, but you can also quickly end up paying €1,200 to €1,300 per day. As always, there is no upper limit.