[ Pricing ]
AI-powered pentesting
01Automated discovery and exploitation of known vulnerability classes, triaged by AI and reviewed by a tester before release.
Manual penetration test
02A named, certified tester tests your target by hand for days, chaining findings until each has a working proof. This is the one auditors mean.
Continuous testing
03Scheduled engagements across your estate, continuous scanning between them, and a red team exercise once your defences are worth testing.
Prices in USD, excluding tax. Manual engagement pricing scales with scope, the figures below are typical starting points, confirmed in writing before any work begins.
[ New ]
For qualifying manual assessments where we have full access. If the engagement produces no High or Critical findings under the agreed classification, we refund 100% of the assessment fee back on your invoice. Confirmed in writing before we touch a packet.
Applies to grey box and white box engagements. Excludes black box, scans, and retests. Terms set in the engagement letter.
[ 02 / By engagement ]
Duration is the honest range for a mid-size scope. Where a figure says scoped, the spread between a small and a large estate is wide enough that quoting a number would be guessing.
| Engagement | Typical duration | You provide | From |
|---|---|---|---|
| Black Box Penetration Testing | 3-5 days | Target name only | $700 |
| Grey Box Penetration Testing | 5-10 days | Low-privilege credentials, basic architecture notes | Scoped |
| White Box Penetration Testing | 10-15 days | Source code, architecture, admin credentials | Scoped |
| Web Application Penetration Testing | 5-10 days | Credentials for each role | Scoped |
| API Penetration Testing | 4-8 days | Spec or collection, plus per-role tokens | Scoped |
| Mobile Application Penetration Testing | 6-10 days | Builds for both platforms, test accounts | Scoped |
| External Network Penetration Testing | 3-7 days | IP ranges and domains | Scoped |
| Internal Network Penetration Testing | 5-10 days | Network access, standard user account | Scoped |
| Active Directory Security Assessment | 5-10 days | One standard domain account | Scoped |
| Cloud Penetration Testing | 5-10 days | Read-only audit role, plus a low-privilege identity | Scoped |
| Firewall Configuration Review | 3-5 days | Read-only access to firewall configurations | Scoped |
| Red Team Assessment | 3-6 weeks | Objective only, agreed with a small internal group | Scoped |
| AI & LLM Penetration Testing | 5-10 days | System access, tool definitions, prompt architecture | Scoped |
[ 03 / Always included ]
One full retest of every finding, within 90 days.
Unlimited seats for your team, for as long as you are a client.
Shareable proof of testing for customers and auditors.
Ninety minutes with the tester who ran the test.
Specific fixes, not links to generic OWASP pages.
Where your change window requires it.
Scope size and depth: the number of live hosts, applications, user roles and API endpoints, and how many days of manual testing that implies. Not your company size, not your industry, and not how urgently you need it.
Yes. The scope document contains the price, and it does not change unless you change the scope. If we find during the engagement that the scope was described inaccurately, we tell you immediately and you decide what happens next.
No. One retest of every confirmed finding is included with each manual engagement, valid for 90 days after the report. You do not need a new purchase order and it does not need a new scoping call.
Yes. A single AI-powered scan is $399 with no commitment. A monthly plan works out cheaper if you are running scans on every release, and we will tell you when you have crossed that line.
Our starting prices are already set low enough that we do not run a separate startup programme. If a genuine budget constraint is the only thing standing between you and a test, say so on the call.
Describe the target and the deadline. Most scopes come back the same working day, with the number on the first page.