Penetration testing cost in India (2026 buyer guide)

Search results often show dramatic low prices. Those headlines may reflect scanner-only output, tiny asset counts, student projects, or scopes that exclude authenticated testing. A professional engagement budget should cover: time for manual validation, a readable report, remediation discussion, and at least one retest window for in-scope fixes.

PoCForge publishes ranges so you can plan against a named provider. We will still say when a lighter scan-style exercise is enough — and when it is not — during scoping.

When you evaluate vendors, align scope first. Ask each firm to price the same asset list, roles and environments. Clarify whether the fee includes manual validation, a written report, and a remediation retest. Be cautious of titles that lead with “CERT-In empanelled” or “from ₹X” if the statement of work is vague — verify empanelment on the official CERT-In list when it matters, and read our CERT-In decision guide.

Useful comparison questions:

• What is explicitly out of scope?
• How many roles and tenants are included?
• Is retesting included, and for how long?
• Who writes the report, and can we see a redacted sample?
• What happens if critical production issues appear mid-test?

Public India cost guides and boutique price lists commonly show entry web/API work in the tens of thousands of rupees, with larger multi-surface or regulated programmes climbing higher. Treat any “average market price” or “top 10 firm” claim sceptically unless the author shows methodology. PoCForge publishes its own ranges so you can budget against a named provider, then adjust for your scope.

Early-stage SaaS (web + core API). Often lands near the web+API band (₹55,000 – ₹1,10,000 + GST) when roles and environments stay modest.

Growth product with mobile. Add per-platform mobile ranges; confirm whether the same API is already covered under web+API to avoid double-counting.

Perimeter check. A focused external infrastructure test (₹25,000 – ₹65,000 + GST typical) pairs well with application testing when customers ask about internet exposure.

Internal identity. Active Directory / internal network work is usually a separate, deeper programme — plan the higher band and clear objectives before kickoff.

AI feature launch. Budget the AI/LLM band in addition to ordinary API authz testing when copilots or agents can touch customer data or tools.

Indicative PoCForge prices are shown excluding GST; applicable taxes are added on the invoice. Payment milestones, PoC limits and confidentiality terms appear in the statement of work / agreement. We do not publish client names without permission.

• Physical security and social engineering (unless explicitly agreed)
• Denial-of-service stress testing
• Source code review
• Unlimited retest rounds after the included window
• Guaranteeing “zero vulnerabilities” — no tester can
• CERT-In empanelment claims — verify officially if required

Send the application type, approximate endpoints or APIs, user roles, environment count, target timeline and any customer or compliance requirement. Include whether you need CERT-In empanelment specifically. We respond with clarifying questions and a defined statement of work. Use contact or the homepage form.