Home / Pricing
Penetration testing pricing
Every engagement is scoped to your environment and priced with a fixed proposal — no hourly surprises. Starting prices are a floor — your final price depends on scope.
MOST POPULAR
Web App & API Penetration Test
Manual testing of a web application and its APIs — the test most SOC 2, insurance and customer security reviews ask for.
Starting at $5,500
- Authenticated testing across user roles
- OWASP WSTG & API Top 10 coverage
- Auditor-ready report & attestation letter
- Free retest of all findings within 6 months
- Final price set by scope
AI & LLM Security Assessment
An LLM app, copilot or agent tested end to end — prompts, retrieval, tools and permissions.
Starting at $7,500
- Prompt injection & jailbreak testing
- Data leakage & system prompt extraction
- Agent, tool & MCP abuse (if present)
- OWASP LLM Top 10 & MITRE ATLAS mapping
- Final price set by scope
Pentesting as a Service (PTaaS)
Ongoing, on-demand testing built into your development cycle — not a once-a-year snapshot.
Subscription scoped to your release cadence
- Continuous vulnerability discovery
- Real-time finding delivery
- Retests included during your term
- Quarterly reporting for SOC 2 evidence
- White-label option for MSPs
Everything else — fully scoped
External & internal network, Active Directory, cloud, mobile, desktop apps, ICS/OT, red team, wireless, physical, threat modeling and vulnerability assessments — or any combination.
Fixed proposal
- Free scoping call, reply within 24 hours
- Fixed scope, price and timeline
- Combine any of our 19 disciplines
- Compliance mapping on request
- Covered under NDA
What drives the price
- Number of external IPs, applications, APIs or user roles in scope
- Authenticated vs. unauthenticated testing
- Number of AI agents, tools and MCP servers
- On-site requirements (wireless, physical, ICS/OT)
- Compliance mapping and report format your auditor needs
Every engagement includes
- Named operator from kickoff to readout
- Kill Chain Replay™ attack paths
- Executive summary + technical findings
- Remediation guidance and live readout call
- Free retest of all reported findings within 6 months
- Attestation letter for customers and auditors