Published starting points, quoted on your scope
Each service below shows where pricing starts and what moves it. Every engagement includes a retest. Your final quote follows a short scope review.
Global pricing in USD, taxes as applicable.
What moves the price
Testing is priced on effort. These are the factors we ask about first.
The four factors in detail
Size of the targetApplications, endpoints, hosts, cloud accounts or sites in scope.
Roles and accessUser roles, tenants and privilege levels that need separate testing.
DepthCore attack paths, or expanded business logic and chained attacks.
ConstraintsTesting windows, environments, compliance evidence and on-site needs.
Starting points by service
Starting prices are for a small, typical scope. Services marked “scoped individually” are quoted after a call.
Application security
Web application
- Priced on
- Roles, user journeys, authentication methods, environments and business logic depth.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
API security
- Priced on
- Endpoint count, authentication schemes, tenancy model and GraphQL or REST coverage.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Mobile application
- Priced on
- Platforms (Android, iOS), build access, backend APIs and on-device storage. Priced per platform.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Desktop / thick client
- Priced on
- Platforms, IPC and update mechanisms, local privileges and backend services.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
AI / LLM applications
- Priced on
- Models and prompts in scope, tools and agents, data sources and retrieval pipelines.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Infrastructure testing
External infrastructure
- Priced on
- Public IPs and hosts, domains, exposed services, VPN and remote access.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Internal network and Active Directory
- Priced on
- Sites, subnets, domains and forests, starting access level and testing window.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Wireless
- Priced on
- Sites and floors, SSIDs, authentication types and guest network segregation.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Cloud security
AWS security assessment
- Priced on
- Accounts, regions, services in use and identity design.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Azure security assessment
- Priced on
- Subscriptions, management groups, services in use and identity design.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
GCP security assessment
- Priced on
- Projects, folders, services in use and identity design.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Microsoft 365 security assessment
- Priced on
- Tenant size, identity and access setup, collaboration sharing and device management.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Microsoft cloud readiness assessment
- Priced on
- Azure subscriptions, Microsoft 365 tenant and whether a breach assessment is included.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Adversary simulation
Red team assessment
- Priced on
- Objectives, duration, channels allowed and whether physical intrusion is included.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Assumed breach assessment
- Priced on
- Starting point, environment size, number of objectives and whether cloud identity and a detection review are included.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Social engineering
- Priced on
- Number of targets, channels (email, phone, identity) and campaign length.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Physical intrusion
- Priced on
- Sites, entry points in scope, access control types and authorisation requirements.
- Retest
- Retest of up to 10 issues within 6 months of the original test.
Included in every engagement
- Scoping call and a written statement of work
- Manual, human-led testing with targeted tooling
- Proof-of-concept evidence for each finding
- Executive summary and technical report
- Remediation steps for the people who own each fix
- Walkthrough call with your team
- Retest of up to 10 issues within 6 months of the original test.
- Updated report after the retest
Pricing questions
Why do you show starting prices instead of fixed packages?
Two applications of similar size can need very different effort. Roles, integrations and business logic change how long careful testing takes. Starting prices help you plan, and the quote follows a short scope review.
What is included in the retest?
Each engagement includes a retest of up to 10 issues within 6 months of the original test. We confirm whether each fix works and update the report. Larger retests can be scoped separately.
What counts as one asset?
Usually one application, one API, one mobile app per platform, one cloud account, subscription or project, or one network range. We agree definitions in the statement of work before testing starts.
Why do some services say "scoped individually"?
Red team, social engineering, physical intrusion, wireless and Microsoft 365 work varies too much by objective, sites and tenant setup for a fair published starting price. We quote these after a scoping call.
Which region's pricing applies to us?
India pricing in INR (plus GST) applies to organisations contracting in India. Global pricing in USD applies elsewhere, with taxes as applicable. Use the region switch at the top of the page.
Can we combine several services?
Yes. Testing related surfaces together, such as a web application and its API, usually costs less than testing them separately. We reflect this in the quote.
Do you offer annual programmes?
Most work is a one-off engagement. If you need several tests across a year, ask about an annual programme during scoping.
Does testing affect production?
Testing is planned to avoid disruption. We agree windows, rate limits and anything off limits in advance, and can test staging environments where they match production.
What do we receive at the end?
An executive summary, technical findings with evidence and remediation steps, a walkthrough call and the retest report.
Is physical testing authorised in writing?
Always. Physical and social engineering work runs only under a signed authorisation letter, agreed rules of engagement and named stop contacts.
Need an exact figure? Send us your scope
Tell us what you want tested. We reply with a statement of work and a fixed quote.
