Penetration testing in India costs between INR 50,000 and INR 15 lakh in 2026, and the band you need is set by who has to accept the report, not by the size of your application. Three bands: budget (INR 50,000 to 1 lakh, usually automated scan output), professional (INR 1 lakh to 3 lakh, manual and methodology-driven, accepted by SOC 2 and ISO 27001 auditors), and enterprise or CERT-In empanelled (INR 3 lakh to 15 lakh+, multi-week, regulated sectors).
Cybersecify publishes fixed prices in the professional band. Startup Pentest is INR 74,999 (~USD 790 / ~GBP 585 / ~EUR 680): 1 scope, 5 business days, 6 hours of founder-led consulting, 1 free retest. Growth Pentest is INR 1,79,999 (~USD 1,890 / ~GBP 1,400 / ~EUR 1,640): 2 scopes, 10 business days, 12 hours of founder-led consulting, SOC 2 + ISO 27001 audit prep, a signed Letter of Attestation, 1 free retest. Both follow PTES and OWASP WSTG v4.2. Both founders run every engagement personally. Full detail is on the pricing page and the deliverable itself is on the sample report, so you can check the work before you talk to us.
The rest of this guide is the part you cannot get from a price list: what each band actually buys, why two quotes at the same number can differ enormously, how to read a vendor quote, and how the spend compares to the cost of the thing it is meant to prevent.
Key findings
- Pentest pricing in India splits into three bands in 2026. Budget (INR 50,000 to 1 lakh) is usually automated scan output. Professional (INR 1 lakh to 3 lakh) is methodology-driven manual testing. Enterprise and empanelled (INR 3 lakh to 15 lakh+) is multi-week, regulated-sector work.
- The published global floor for anything sold as a “pentest” is about USD 3,500 per test, and those tests are automated. Cobalt lists an autonomous pentest at USD 3,500 per test and Intruder lists AI-driven web application pentests from USD 3,500 per test. Price alone will not tell you whether a human tested your application.
- Cybersecify Startup Pentest (INR 74,999) and Growth Pentest (INR 1,79,999) sit in the professional band. Both follow PTES + OWASP WSTG v4.2 and produce technical + executive reports with reproduction steps and remediation guidance.
- Pentest cost is driven by seven factors, not one number. Scope size, methodology depth, tester seniority, report quality, retest practice, compliance mapping, and timeline.
- A pentest at INR 75,000 to 1,80,000 is roughly 0.03 to 0.07 percent of the INR 25.5 crore average breach cost in India reported by IBM for 2026. That is a ratio of about 1,400 to 1 at the top of our price band and 3,400 to 1 at the bottom, on cost of prevention against cost of the event.
Pentest pricing in India: what each price band actually buys
The three bands below are market observations, not vendor rankings. They describe what the money typically buys, and the fourth column shows where our own published plans sit so you can place us against the market rather than take our word for it.
| Budget band | Professional band | Enterprise / empanelled band | Where Cybersecify sits | |
|---|---|---|---|---|
| Price (INR) | 50K to 1L | 1L to 3L | 3L to 15L+ | 74,999 (Startup) / 1,79,999 (Growth) |
| What the money usually buys | Automated scanning, light manual review | Senior manual testing, tool-assisted | Multi-tester teams, multi-week, regulatory sign-off | Two founders, manual + tool-assisted |
| Typical scope | 1 web app | 1 to 2 scopes | Multi-scope, custom | 1 scope (Startup) or 2 scopes (Growth); more scopes run in parallel up to 3 at a time |
| Methodology | Scanner-driven | PTES + OWASP WSTG | PTES, NIST 800-115, OWASP, custom | PTES + OWASP WSTG v4.2, plus real-world attack simulation on Growth |
| Report | Scan output, reformatted | Technical + executive, reproduction steps | Audit-grade + executive briefings | Technical + executive, reproduction steps; control mapping and Letter of Attestation on Growth |
| Retest | Commonly excluded or billed separately | Varies by vendor, ask before signing | Usually included, sometimes multi-cycle | 1 full retest within one month of the v1.0 report, both plans |
| SOC 2 / ISO 27001 acceptance | Variable | Generally acceptable | Acceptable | Acceptable; explicit control mapping on Growth |
| CERT-In empanelment | Not empanelled | Usually not empanelled | Often empanelled | Not empanelled |
| Timeline | 2 to 5 days | 5 to 15 days | 15 to 30+ days | 5 business days (Startup) / 10 business days (Growth) |
| Best fit | Tick-box with no buyer pressure | SaaS with a customer, auditor, or investor asking | Regulated sectors and large estates | Seed to Series B SaaS, 1 to 4 scopes, audit or enterprise-deal driven |
Two rules for reading that table. First, audit acceptance is binary. If your customer’s security team or your auditor rejects the report, the spend returned nothing, whatever the number was. Second, empanelment is a regulatory requirement for specific sectors rather than a quality grade, so confirm whether your sector needs it before you pay for it.
Market rates by target type
| Scope | Budget range (India) | Typical duration |
|---|---|---|
| Web application | ₹50,000 to ₹3,00,000 | 5 to 15 days |
| API (REST/GraphQL) | ₹50,000 to ₹2,50,000 | 5 to 10 days |
| Android application | ₹60,000 to ₹2,50,000 | 7 to 12 days |
| iOS application | ₹60,000 to ₹2,50,000 | 7 to 12 days |
| Cloud (AWS/Azure/GCP) | ₹75,000 to ₹4,00,000 | 7 to 15 days |
| IoT / embedded | ₹1,00,000 to ₹5,00,000 | 10 to 20 days |
| AI application | ₹1,00,000 to ₹4,00,000 | 7 to 15 days |
| Network / infrastructure | ₹50,000 to ₹3,00,000 | 5 to 15 days |
These ranges reflect what boutique and mid-tier firms quote in India. Large IT services firms generally price well above this band for equivalent scope, and independent freelancers generally below it.
The seven factors that move a pentest quote
When a vendor quotes a number, seven things set it. Knowing them is how you tell an expensive quote from a poor-value one.
| Factor | What raises the price | What to ask the vendor |
|---|---|---|
| 1. Scope size | More endpoints, more user roles, more business logic, more payment and integration flows | How many endpoints and roles are in scope, and what is explicitly out of scope? |
| 2. Methodology depth | Manual testing against OWASP WSTG v4.2 and PTES instead of scanner-driven testing | What proportion of the engagement is manual? Which standard do you follow? |
| 3. Tester seniority | Senior testers holding OSCP, CREST, or CompTIA PenTest+ rather than checklist-driven juniors | Who is the named lead tester, and can I verify the certification on the issuing registry? |
| 4. Report quality | Reproduction steps, business impact in plain language, stack-specific remediation, framework control mapping | Can I see a redacted sample report before signing? |
| 5. Retest practice | A full retest included in the base price rather than billed as a separate engagement | Is a retest included, how long do I have to use it, and what does the retest report look like? |
| 6. Compliance mapping | SOC 2 Trust Services Criteria or ISO 27001 Annex A mapping per finding, and an attestation letter | Is compliance evidence formatting included or billed separately? |
| 7. Timeline | Rush turnaround, which some firms surcharge | Is there a rush premium, and what is the standard timeline? |
Two of these deserve expanding. On methodology depth, the gap between an automated scan and a manual engagement is business logic flaws, authorization bypasses, chained exploits, and IDOR in financial flows, which is work a scanner does not do. That is the whole argument in DAST vs pentest. On report quality, auditors and enterprise security teams can tell a boilerplate finding list from evidence, which is why our sample report is public and why SOC 2 pentest requirements 2026 covers what auditors actually check.
For reference on our own answers to those seven questions: we do not surcharge for rush turnaround, the price is the price; we include the retest in both plans; and both founders are named, so you always know who is testing. Rathnakara GN (OSCP) leads every engagement.
The vendor models you will be choosing between
Vendor research surfaces the same handful of names, but the more useful cut is by delivery model, because the model predicts price, turnaround, and who actually touches your application far better than the brand does. Prices below are cited only where the vendor publishes them; where a vendor does not publish, we say so rather than estimate.
| Model | How it works | Published pricing | Suits |
|---|---|---|---|
| Scanner-led platform with a manual layer | Continuous automated scanning as the core product, human testing as a tier or add-on | Astra publishes plans on its pricing page including Pentest Basic at USD 1,999/yr and Pentest Plus at USD 5,999/yr per target | Teams that want tooling and testing from one vendor, on a subscription |
| Automated or AI-driven pentest | Largely machine-run testing sold per test | Cobalt lists autonomous pentest at USD 3,500 per test; Intruder lists AI-driven web app pentests from USD 3,500 per test | Fast recurring coverage between manual engagements |
| PtaaS platform with a tester pool | Testing delivered through a platform by a rotating pool of vetted testers, usually on subscription | Human-led tiers are quote-based at Cobalt and comparable platforms | Series B+ teams running a continuous pentest programme |
| Large IT services firm | Multi-tester capacity, wide regulatory empanelment, procurement-friendly brand | Not published; quote-based | Traditional enterprise procurement and regulated sectors |
| Compliance platform add-on | Pentest bundled with or referred alongside a SOC 2 / ISO 27001 automation subscription | Not published separately; quote-based | Teams already committed to that platform who want one contract |
| Independent freelancer | A single tester engaged directly | Not published; negotiated per engagement | Narrow, single-question tests |
| Founder-led boutique (us) | The founders scope, test, write the report, and run the retest | INR 74,999 and INR 1,79,999, published, no sales call required | Seed to Series B SaaS that needs a named senior tester and audit-usable evidence |
Three things worth naming honestly about that table.
Published price does not equal comparable price. Astra’s published numbers are annual, per target, and bundle continuous scanning; ours are one-time for a point-in-time engagement with a named tester and a fixed report date. Those are different products at different cadences, and the right comparison is what you need this quarter, not which number is smaller.
The USD 3,500 published floor is automated. Both Cobalt and Intruder are explicit that the tests at that price are autonomous or AI-driven. That is genuinely useful for recurring coverage, and it is not the same evidence as a manual engagement when an investor or an enterprise security team asks who tested the application and what they found by hand. Check which one you are being sold.
Most of this market does not publish prices at all. Where we have written “not published” above, that is exactly what we mean. We are not going to put a number next to another firm’s name that we cannot point to a source for.
Where we are not the right fit
Being straight about this saves you a call. Send the work elsewhere if you are in a regulated sector that mandates a CERT-In empanelled auditor (banking, NBFC, insurance, telecom, power, government, Critical Information Infrastructure), because empanelment is a regulatory gate we do not hold. Same if you need a multi-week engagement across a large estate of five or more scopes with multiple simultaneous testers, or if your procurement process requires a specific brand-name vendor on an approved list. Between one and four scopes, Seed to Series B, with an auditor or an enterprise customer asking questions, is where we do our best work.
When to spend more and when to spend less
The right spend is the cheapest band that satisfies whoever has to accept the report.
| Your situation | Recommendation | Why |
|---|---|---|
| Pre-seed or seed, one app, no enterprise customers yet | Startup Pentest, INR 74,999 | One scope, 5 business days, 6 consulting hours, retest included. You get an audit-acceptable report ready for the first investor or enterprise prospect who asks. Spending more here is budget you do not need to spend. |
| Series A, two or more apps, first SOC 2 or ISO 27001 push | Growth Pentest, INR 1,79,999 | Two scopes (usually web app + API), SOC 2 + ISO 27001 audit prep, Letter of Attestation, 12 consulting hours, retest included. The INR 1,05,000 step up from Startup buys a second scope, deeper methodology, and compliance evidence that is otherwise a separate line item. |
| Series A or B, three or four scopes | Growth plus additional scopes at INR 74,999 each | Scopes beyond the base two run in parallel, up to three at a time, so a three or four scope engagement still completes in 15 business days. |
| Regulated sector (BFSI, telecom, power, government, CII) | CERT-In empanelled vendor | Your regulator mandates empanelled auditors for certain assessments. Confirm your specific obligation first with when you do not need a CERT-In empanelled vendor. |
| Five or more scopes, or specialised targets | Custom scoping proposal | Large estates, red team simulation, and specialised targets such as hardware or embedded systems need scoping before a number means anything. |
What counts as one scope
One scope is one application surface. Your web app is one scope. Your REST API is a separate scope. Android and iOS are separate scopes, because they are different binaries with different attack surfaces. Your AWS infrastructure is one scope. So a web app plus an API is two scopes, and a web app plus Android plus iOS is three. A microservices backend may count as one scope or several depending on whether the services share authentication and architecture, which is what the scoping call is for. We confirm the count in writing before final pricing.
What else a compliance programme costs
Pentest is one line item. The others help you right-size it.
- SOC 2 (US): audit firms quote per engagement and none publishes a rate card, so get written quotes at your scope. Budget three to six months of internal evidence collection alongside it.
- ISO 27001: certification bodies quote per engagement and per scope. ISMS implementation is costed separately from the audit itself.
- DPDP (India): the DPDP Rules 2025 were notified on 13 November 2025, with the substantive obligations phased in over 18 months. Significant Data Fiduciaries will need independent data auditors when those duties commence. A pentest report forms part of the evidence package.
- CERT-In incident reporting: built into normal pentest scope, no separate cost.
All four expect third-party penetration testing evidence, which makes the pentest the cheapest component of the programme and the one that blocks the others if the report gets rejected.
The ROI question, answered honestly
Founders ask a fair question: is INR 2 lakh on a pentest buying real risk reduction, or a tick-box?
The comparison, using published figures. IBM’s Cost of a Data Breach Report 2026 puts the average breach cost in India at INR 25.5 crore, an all-time high and a 15.9 percent rise on the INR 22 crore recorded for 2025. That is an all-sector average, not a SaaS-specific figure. A pentest at INR 75,000 to 1,80,000 is 0.03 to 0.07 percent of it, a ratio of roughly 1,400 to 1 at the top of our price band and 3,400 to 1 at the bottom. For a Series A SaaS at INR 5 to 10 crore ARR, Growth Pentest is about 0.04 percent of ARR, while low single-digit percentage churn following a public breach disclosure would cost INR 15 to 30 lakh of recurring revenue in year one alone, before legal fees, DPDP Act penalties (up to INR 250 crore for failure to maintain reasonable security safeguards), brand recovery, and the founder time that incident response consumes.
The honest caveat, because you should apply it to anyone quoting these numbers at you including us: this compares a certain cost against an uncertain event, and no pentest removes breach risk. What a pentest reliably does is find the classes of flaw that scanners miss before someone else does, and produce evidence that a buyer, an auditor, or an investor will accept. Treat the ratio as a sense of proportion, not a guaranteed return.
The near-term commercial case is usually the sharper one. Investor diligence at Series A and beyond routinely asks whether the application has been tested, by whom, what was found, and what was fixed. Enterprise procurement asks for the report directly. In our own pipeline we have seen deals stall at exactly the “send us your pentest report” step, and the cost of a stalled round or a slipped enterprise deal is a multiple of the testing spend.
Five pricing mistakes worth avoiding
1. Buying the cheapest quote without checking the report is acceptable. The false-economy pattern we see repeatedly: a founder takes a sub-INR 50,000 quote, receives reformatted scan output, the enterprise customer’s security team rejects it, and the work is redone properly at INR 2.5 lakh. The cheap option becomes the expensive one, and a month of deal time is gone. Fix: ask for a redacted sample report before signing. If it has no reproduction steps, no business impact framing, and no remediation guidance, keep looking.
2. Paying an empanelment premium the regulator never asked for. CERT-In empanelment carries a price premium that is justified for BFSI, telecom, power, government, and CII, and not for most SaaS. If your customer asked for a pentest report rather than specifically a CERT-In empanelled pentest report, empanelment is not the requirement. Fix: confirm your obligation against the empanelment decision guide first.
3. Signing without knowing who tests. Where delivery passes from salesperson to account manager to delivery lead to whoever is available, context is lost at every handoff. Fix: ask in writing for the name of the senior tester, and verify the certification on the issuing body’s registry. A vendor that will not name the tester is telling you something.
4. Skipping the retest. A pentest finds twelve issues, engineering fixes ten, and the report still lists twelve as open. The auditor treats unverified remediation as unremediated, and you are either buying a retest late or explaining the gap. Fix: choose a plan with the retest in the base price and diary it into your release calendar. Ours is one full retest within one month of the v1.0 report, closing with a v2.0 report.
5. Buying compliance mapping before you have a compliance deadline. SOC 2 control mapping in a report is worth real money when an audit is on the calendar and nothing when it is not. Fix: if a customer wants a pentest report and no SOC 2 timeline exists, Startup at INR 74,999 is right-sized. Step up to Growth when a SOC 2 or ISO 27001 push lands within six months.
Alongside those, the quote line items worth querying before you sign: retest fees, compliance evidence formatting billed separately, hourly scope-creep charges, per-vulnerability pricing (which incentivises reporting noise), twelve-month contracts for what is a point-in-time engagement, and rush premiums.
Our pricing
We publish our prices because founders should not have to sit through a sales call to find out what a pentest costs.
Startup Pentest: INR 74,999 + taxes
- 1 scope (web, API, Android, iOS, cloud, or IoT), with a second scope available at INR 44,999 and a two-scope maximum on this plan
- 5 business days from kickoff to report, business days being Monday to Friday; a second scope adds 5 business days, so two scopes complete in 10
- 6 hours of founder-led security consulting, useable for 6 months from kickoff
- Technical + executive report
- 1 full retest within one month of the v1.0 report, closing with a v2.0 report
- OWASP WSTG v4.2 + PTES methodology
Growth Pentest: INR 1,79,999 + taxes
- 2 scopes (web + API, Android + iOS, or any combination), with additional scopes at INR 74,999 each
- 10 business days from kickoff to report; from the 3rd scope onward, scopes run in parallel up to 3 at a time at +5 business days per batch, so a 3 or 4 scope engagement completes in 15 business days, and 5+ scopes get a custom scoping proposal
- 12 hours of founder-led security consulting, useable for 12 months from kickoff
- Technical + executive report with SOC 2 Trust Services Criteria and ISO 27001 Annex A control mapping per finding
- Signed Letter of Attestation
- 1 full retest within one month of the v1.0 report, closing with a v2.0 report
- OWASP WSTG v4.2 + PTES methodology, plus real-world attack simulation beyond OWASP Top 10
International equivalents
Many of our clients are outside India. Conversions below were calculated on 2026-08-08 at 1 USD ≈ ₹95, 1 GBP ≈ ₹128, 1 EUR ≈ ₹110, 1 SGD ≈ ₹75, 1 AUD ≈ ₹67, 1 HKD ≈ ₹12, and are indicative only. We invoice in INR per Indian regulation, and international clients pay by wire at the FX rate prevailing at invoice date.
| Plan | INR | USD | GBP | EUR | SGD | AUD | HKD |
|---|---|---|---|---|---|---|---|
| Startup Pentest | 74,999 | ~790 | ~585 | ~680 | ~1,000 | ~1,120 | ~6,250 |
| Growth Pentest | 1,79,999 | ~1,890 | ~1,405 | ~1,640 | ~2,400 | ~2,685 | ~15,000 |
Full pricing details | SaaS pentest for India | Our methodology | Sample report | Web application pentest | API pentest
The bottom line
Pentest cost in India in 2026 runs from INR 50,000 to INR 15 lakh+ depending on band. For most SaaS startups the right number is INR 75,000 to 1.8 lakh, buying a focused manual engagement by named senior testers and a report that an auditor and an enterprise buyer will accept as evidence.
The number on the quote is the least informative thing about it. What matters is how many hours of senior human testing it buys, who does them, whether a retest is included, and whether the report will survive contact with the person who has to approve it. Those are four questions you can ask any vendor, including us, before any money moves. The 5 questions to ask a pentest vendor before signing covers the rest, and this guide sits in our Pentest Buyer-Education series alongside the what is penetration testing pillar.
If you would rather see what is exposed before you scope anything, run a free external attack surface snapshot on your domain.
We are a founder-led cybersecurity firm in Bengaluru working with AI-first and API-first SaaS startups, Seed to Series B. Both founders are personally involved in every engagement. Our team holds OSCP, CISSP, CEH, and ISO 27001 Lead Auditor certifications. See our AI application pentest service page for scope details, or contact us directly.
Corrections
- 2026-08-09: Updated the IBM breach-cost comparison from the 2024 edition to the current one. IBM’s Cost of a Data Breach Report 2026 puts the India average at INR 25.5 crore, an all-time high and a 15.9 percent rise on 2025, replacing the INR 19.5 crore figure previously published (IBM India newsroom, 3 August 2026). The derived percentages and ratio were recalculated: a pentest at INR 75,000 to 1,80,000 is 0.03 to 0.07 percent of the average, a ratio of roughly 1,400 to 1 to 3,400 to 1, correcting the earlier “about 1,000 to 1”.
- 2026-08-09: Removed the global USD breach-average figure and the USD conversion of the India figure, neither of which could be verified against IBM’s own current publication.
- 2026-08-09: Removed unsourced cost bands for SOC 2 Type 2 audits and ISO 27001 certification. Neither audit firms nor certification bodies publish rate cards.
- 2026-08-09: Corrected the Cobalt pricing link, which had moved to /platform/pricing, and the name of Astra’s second pentest tier, which is Pentest Plus.