Work backwards from the launch date, not forwards from today. That single change is what makes the arithmetic honest, and it is the first thing we do on a scoping call.
A one-scope engagement with us is 6 business days: 5 testing, 1 writing the report. The report is produced inside the window, never added on top. Two scopes is 12. But the test duration is rarely what decides whether testing changes your launch.
The three things around the test, which are usually the constraint
Access verification comes first, and it is the step engagements most often stall on. It needs credentials, a working environment, and someone on your side who can unblock them when they do not work. It is also the step that moves the quote in both directions: two surfaces may turn out to fit inside one scope, or something may need a scope of its own.
Remediation usually takes longer than testing, and it is your engineering time rather than ours. A handful of medium findings is days. An authorization or tenancy flaw can be weeks, because the fix is a design change rather than a patch.
A retest needs to fit after the fixes land if you want evidence the findings are closed. Ours is 1 to 3 business days and is included.
So how late is too late?
| Start before launch | What you can realistically have |
|---|---|
| 6+ weeks | Test, remediation, retest, and a clean v2.0 report before you go live |
| 3 to 4 weeks | Test and a report before launch. Remediation of anything structural lands after |
| 2 weeks | A report before launch. Not a remediated product, unless almost nothing is found |
| Under 1 week | A conversation about which single scope buys the most information |
🔴 None of those is a failure state. A report in hand with known findings and a dated fix plan is a defensible position in front of a customer or an investor. What is not defensible is launching with no idea what is there.
If the date is immovable and close, the honest conversation is which one scope buys the most information, usually the authentication and authorization surface, rather than how to compress everything into the gap.
Do you actually need one before launch?
That depends on what the launch commits you to, not on the launch itself.
Three situations make it close to unavoidable:
- A customer, investor or acquirer will ask for a report as a condition. The date is theirs, not yours.
- You are listing on a platform programme. Amazon SP-API, Microsoft 365 Certification or Shopify set both the requirement and the clock.
- You handle payment, health or regulated personal data from day one. The exposure starts at launch whether or not anyone has asked.
Where none of those apply, it is a judgement about risk appetite rather than a requirement, and we will say so rather than sell you one.
The honest argument against testing pre-launch
Worth putting here rather than burying it, because it is real.
A test on a product nobody uses yet finds fewer genuine problems than a test on one with live traffic and real integrations. Business-logic flaws live in how a system is actually used. Pre-launch, some of that does not exist to be found.
The counter-argument, which is why most teams still do it: the cost of fixing an architecture-level flaw rises steeply after launch, because by then it has users and data attached to it. An authorization model that is wrong is cheap to change with zero tenants and expensive with two hundred.
The pattern we see work when nothing external forces the date: a pre-launch test scoped to authentication and authorization, where a flaw is most expensive to fix later, then a fuller test once the product has been live long enough to have real usage.
What it costs, so you can do the arithmetic yourself
Essentials Plan, INR 74,999, one scope over 6 business days. Built for a customer, investor or acquirer evaluating you.
Compliance Plan, INR 1,79,999, two scopes over 12 business days. Adds SOC 2 and ISO 27001 control mapping per finding and a signed Letter of Attestation. Built for getting or renewing a compliance certificate.
Neither plan caps scopes: further scopes are INR 44,999 each on Essentials and INR 74,999 on Compliance. Both include founder-led consulting hours and one free retest within one month of the v1.0 report, closing with a v2.0 report. We publish these so you can work out whether the dates fit before you talk to anyone. Current figures on pricing.
Where to go next
If your product was built fast with AI coding tools, the scope questions are different enough to be worth their own read: pre-launch pentest for vibe-coded SaaS covers the eight-point checklist and what not to test.
If a launch date is already fixed, tell us the date and the architecture and we will tell you honestly what fits and what does not. That answer is free and is sometimes “not this, not in that window”.
Corrections and updates
We publish corrections rather than editing them away, so a reader who acted on an earlier version can see what changed. Some entries record a change in the source document itself, others record our own error. Dates are our review dates, not the source's change date.
Errors in this page are corrected in place with a dated note. If you believe something here is wrong, tell us at errors@cybersecify.com and we will check it and publish the outcome either way. Our corrections policy sets out how.
A note on what is ours and what is general. The 6-business-days-per-scope figure, the plan prices and the retest window are our own published terms. The sequencing argument, the table above and the pre-launch-versus-post-launch trade-off are our judgement from delivered engagements, not an industry standard, and you should weigh them as that.