How much does a cybersecurity risk assessment cost? (2026)

A consultant-led cybersecurity risk assessment typically costs about $6K–$16K for a small business, $15K–$50K for a mid-market company, and $45K–$150K or more for an enterprise (SecurityBudget estimates, worked below). Narrower assessments cost less: a vulnerability assessment usually runs $1K–$5K and a consultant-led HIPAA security risk assessment $5K–$15K+, while adding a penetration test adds $5K–$50K per engagement.

This page covers assessments: risk, gap, maturity, vulnerability, cloud and vendor reviews. Certification audits (SOC 2, ISO 27001, PCI DSS) are priced differently and covered in how much a cybersecurity audit costs.

Cost by assessment type

Assessment	Typical cost	What you get
Cybersecurity risk assessment (NIST SP 800-30 / CSF-based)	~$6K–$150K+ by company size (estimate)	Threats, likelihood and impact scored into a risk register, plus a roadmap
Gap / maturity assessment (NIST CSF 2.0, CIS Controls)	~$5K–$20K (estimate); more for multi-unit enterprises	Current vs target scores against a framework
HIPAA security risk assessment	$0 DIY; ~$499/yr software; $5K–$15K+ consultant	The risk analysis the HIPAA Security Rule requires
Vulnerability assessment	~$1K–$5K per assessment	Automated scanning plus prioritized findings
Penetration test	$5K–$50K, ~$18K typical	People actively trying to exploit weaknesses
Cloud security assessment	~$5K–$25K per cloud provider (estimate)	Identity, network and configuration review of AWS, Azure or GCP
Third-party / vendor risk assessment	~$80–$1,600 per vendor in staff time (estimate)	Questionnaire, evidence review and a risk rating for a supplier

Ranges marked “estimate” are SecurityBudget figures built from consultant hours times a blended rate, with assumptions shown in the next section. The penetration test range matches the unit cost in our calculator.

Cost by company size

SecurityBudget estimates for a consultant-led risk assessment:

Company size	Typical scope	Consultant hours	Risk assessment	Add technical testing
Small (under 100 employees, 1–2 sites)	4–8 interviews, one framework, external scan	40–80	$6K–$16K	+$5K–$15K
Mid-market (100–1,000 employees, hybrid cloud)	10–25 interviews, one or two frameworks, sampled control testing	100–250	$15K–$50K	+$15K–$40K
Enterprise (1,000+ employees, multi-site, multi-cloud)	30+ interviews, several frameworks, business-unit risk registers	300–750+	$45K–$150K+	+$40K–$150K+

Assumptions: hours cover document review, interviews, control validation, risk scoring, the report and an executive readout. We use a blended $150–$200 an hour: above the $100–$149 average hourly rate Clutch reports for cybersecurity providers, and below the $200–$400 senior advisory rates in our cybersecurity services pricing guide. The testing column assumes one to several penetration tests at our $5K–$50K unit cost.

Published guides land in a similar place. One consultancy’s guide puts small-business assessments at $3,000–$10,000, mid-sized at $10,000–$50,000 and enterprise at $50,000–$150,000+, with penetration testing folded into the enterprise tier. Another IT provider’s guide puts a 10–50 employee office at $6,000–$18,000. Both firms sell security services, so treat these as vendor guides, not surveys.

What each assessment type covers

Risk assessment vs gap assessment. A risk assessment asks what could go wrong and how much it would hurt: it identifies assets, threats and vulnerabilities, then scores likelihood and impact. NIST’s SP 800-30 Rev. 1 is the standard reference method. A gap or maturity assessment scores your controls against a framework such as NIST CSF 2.0, released in February 2024, or the CIS Controls. It involves less analysis: our estimate of 30–100 hours gives ~$5K–$20K. Many buyers combine both in one engagement.

HIPAA security risk assessment. The HIPAA Security Rule requires covered entities and business associates to conduct a risk assessment. HHS says the Rule does not prescribe a specific methodology. Medcurity, which sells HIPAA software, prices its small-practice tier at about $499 a year and reports consultant-led assessments at $5,000–$15,000+. Its guide adds that an onsite walkthrough can add $1,500–$5,000. For the cost of the wider HIPAA program, see our audit cost guide.

Vulnerability assessment vs penetration test. A vulnerability assessment is mostly automated scanning plus triage. VikingCloud’s guide puts it at $1,000–$5,000, and scanner subscriptions such as Astra’s start at $1,999 a year. A penetration test has people trying to break in, at $5K–$50K per engagement (around $18K typical in our model). A scan feeds a risk assessment. It does not replace one.

Cloud security assessment. This reviews identity and access, network exposure, logging, encryption and configuration in each cloud account. Our estimate of 30–125 hours at $150–$200 gives ~$5K–$25K for one provider. Multi-cloud estates, or adding a cloud penetration test, push it higher. Before paying anyone, turn on Microsoft Defender for Cloud’s Foundational CSPM. It is free and checks Azure, AWS and Google Cloud against Microsoft’s cloud security benchmark.

Third-party / vendor risk assessment. This is usually done in-house, vendor by vendor. At a loaded ~$81 an hour (our BLS-based $168K per security FTE over 2,080 hours), our estimate is ~$80–$160 for a low-risk vendor (1–2 hours) and ~$650–$1,600 for a critical one (8–20 hours). Platforms add a software cost: UpGuard’s Standard vendor-risk plan is $1,750 a month billed annually for 50 vendors, about $420 per vendor per year.

Free and low-cost options

• CISA Cyber Hygiene. No-cost vulnerability scanning of internet-facing public, static IPv4 addresses, with weekly reports and alerts on urgent findings, plus web application scanning. It is open to U.S. federal, state, local, tribal and territorial governments and to public and private critical infrastructure organizations. CISA says services usually start within three business days of sign-up.
• CISA self-assessment. The Cyber Security Evaluation Tool (CSET) is a desktop tool for checking your own posture against recognized standards. CISA also runs a catalog of no-cost services, Cybersecurity Performance Goals for prioritizing, and regional advisors across 10 regions.
• HHS SRA Tool. ONC and HHS OCR publish the Security Risk Assessment Tool (version 3.7, Windows app or Excel workbook). ONC says it targets small and medium providers and may not suit larger organizations.
• NIST CSF Profile template. NIST’s downloadable Organizational Profile spreadsheet puts Current and Target Profiles side by side so you can spot gaps.
• CIS CSAT. The hosted version of the CIS Controls Self Assessment Tool is free for non-commercial use to assess your own organization.

Free tools still cost staff time, and a self-assessment is not independent. Use them for a baseline, then pay for an outside view when a board, insurer, customer or regulator needs one.

What drives the price

1. Scope. The number of legal entities, sites and business units in scope.
2. Assets. Endpoints, servers, cloud accounts and critical applications to review.
3. Frameworks. Each additional framework adds control mapping and evidence review.
4. Interviews and onsite time. More stakeholders and travel mean more hours.
5. Technical testing. Scanning, configuration review or penetration testing included or excluded.
6. Report depth. A short executive summary costs less than a scored risk register for every asset.
7. Remediation roadmap. Prioritized fixes with effort and cost estimates, retesting and a board readout all add hours and value.

How to scope an RFP

Give bidders the facts they need to price: headcount, sites, endpoint and server counts, cloud accounts, key applications and regulated data types. Name the method you want (NIST CSF 2.0 scoring, an SP 800-30-style risk register, CIS Controls) and say whether technical testing is in scope. List the deliverables: risk register with likelihood and impact, current and target scores, a 12–24 month roadmap with costs, and an executive readout. Ask for a fixed fee with stated assumptions, change-order rates, the names and roles of the people doing the work, and a redacted sample report.

Red flags

• Templated reports. If the sample report could describe any company, yours will too. Findings should reference your systems and interviews.
• An automated scan sold as an assessment. If the deliverable is a scanner export with no interviews or governance review, you are buying a $1K–$5K scan at risk-assessment prices.
• No named methodology or scoring. You can’t compare results year to year without one.
• Fixed price, no assumptions. Expect change orders once the real asset count appears.
• A roadmap that points mostly to the assessor’s own products.

Low-cost checks are fine as triage. One provider publishes one- to four-hour checks for $249–$4,499 depending on headcount and says they are not a formal audit or full penetration test. Don’t compare them line for line with a full risk assessment.

How often to reassess

For HIPAA, HHS notes the Security Rule does not set a frequency: some organizations reassess annually, others as needed, with examples running up to every three years. Our recommendation: a full independent assessment every two to three years, a lighter internal update of the risk register each year, and an off-cycle reassessment after an acquisition, a major cloud migration, a new type of regulated data or a significant incident. Vulnerability scanning should run continuously.

DIY vs consultant vs vCISO

Approach	Cost	Best for	Trade-off
DIY with free tools	$0 in tools; 40–80 staff hours ($3K–$6.5K at $81/hr, estimate)	First baseline, small HIPAA practices	No independence; quality depends on who runs it
One-time consultant	~$6K–$150K+ by size (estimate above)	An independent view for a board, insurer or customer	Point in time; the roadmap can sit unused
vCISO	$200–$400/hr or a $5K–$15K/mo retainer	Organizations that need someone to own remediation	Ongoing cost; the assessor also implements

vCISO ranges come from our services pricing guide. A common middle path is one independent assessment, then a vCISO or internal owner to run the roadmap.

FAQ

How much does a cybersecurity assessment cost for a small business?

For a company under 100 employees, a consultant-led risk assessment runs about $6K–$16K in our estimates, or $11K–$31K with a vulnerability assessment or small penetration test added. A HIPAA-only practice can start at $0 with the HHS SRA Tool.

What does IT risk assessment pricing usually include?

“IT risk assessment” and “cybersecurity risk assessment” are usually the same engagement. A complete quote covers interviews, document review, control validation, a scored risk register and a remediation roadmap. Technical testing and onsite travel are often priced separately, so ask.

Is there a free cybersecurity risk assessment?

Free self-assessment tools exist: CISA’s CSET, NIST’s CSF Profile template, CIS CSAT and the HHS SRA Tool. CISA’s Cyber Hygiene scanning is free if you are an eligible government or critical infrastructure organization. A vendor’s “free assessment” is often part of a sales process, so check what it covers before relying on it.

How much does a cyber security risk assessment cost for a mid-sized company?

About $15K–$50K for 100–1,000 employees in our estimates, depending on sites, frameworks and interview count. Add $15K–$40K if you bundle penetration testing.

Put the assessment in your budget

An assessment pays off when its roadmap becomes funded line items. Use the findings to build a defensible cybersecurity budget, compare your spend with cybersecurity budgets by company size, and model the remediation costs in the free, ungated cybersecurity budget calculator.