Penetration testing prices before the first call.
Three packages. A fixed price after a short call. A retest in every one.
Prices for the United States and elsewhere. Change currency at the top right.
Three packages
Each one is tested by a person, not just a scanner, and ends with a report your customer can read.
Focused test
One website, app or API. Right for a launch or a first customer review.
- One app or API
- Up to two types of user
- Report and one retest
Product test
A full SaaS product, where each customer must only see their own data.
- Your app and its API
- Up to five types of user, customer data kept apart
- Walkthrough call and one retest
Release programme
Two tests a year, for teams that ship often and answer security reviews all year.
- Two full tests, timed around your releases
- Quick checks when a big feature ships
- A current report whenever a customer asks
What each package covers
Half-filled means included when your app has it.
| Covers | Focused test | Product test | Release programme |
|---|---|---|---|
| Website or app | Conditional | In scope | In scope |
| API | Conditional | In scope | In scope |
| Types of user tested | Up to 2 | Up to 5 | Up to 5 per test |
| Customer data kept apart | Conditional | In scope | In scope |
| Single sign-on (SSO) | Not applicable | Conditional | Conditional |
| One-page summary for your customer | In scope | In scope | In scope |
| Walkthrough call | Conditional | In scope | In scope |
| Retest | Within 60 days | Within 90 days | After each test |
| Checks between tests | Not applicable | Not applicable | In scope |
In scope included Conditional conditional Not applicable not part of the package
What moves the price
The bigger your app, the more days of testing.
- Types of user
- Admins, managers, members: each one is a separate set of doors to test.
- Customer accounts
- If many companies share your app, we check none can see another’s data.
- Size of the API
- More endpoints, more to test.
- Connections to other systems
- Single sign-on, payments and integrations each add work.
How the weeks run
Most of the time is your team fixing things. Plan the retest around your release.
Quoted individually
Priced after a call.
- AI application securityDepends on what the model can read and which tools it can call.
- Integration security reviewsSized by the number of identity providers, SCIM clients and callbacks.
- Investment security diligenceSized by the number of companies and whether light testing is authorised.
- Security engineeringScoped as a fixed piece of engineering work or a monthly allocation.
Pricing questions
How much does a penetration test cost?
From ₹79,000, £3,500 or $3,900 for one app or API; from ₹1,49,000, £6,900 or $7,900 for a full SaaS product; from ₹2,99,000, £12,900 or $14,900 a year for two tests. Every price includes a retest.
Why “from”?
It is the price at the small end of each package. After a short call we give you a fixed price, and it does not change unless you add to the scope.
Is the retest really included?
Yes. Once your team has fixed the issues, we check the fixes and update the report.
What if our app is bigger than the package?
The quote tells you how much more and why. Big products are often better split into two tests around two releases.
Do agencies pay the same?
Yes. How an agency resells or refers is agreed per project; see the partners page.
Get a fixed quote for your scope.
Tell us about your app and who asked for the test. We reply with a fixed price.