An outsourced pentest engagement costs INR 75,000 to INR 5 lakh per scope (USD 900 to USD 6,000 approximately at Indian boutique pricing, USD 8,000 to USD 25,000 at US boutique pricing) and 14 to 21 calendar days end to end. The biggest cost is not the budget; it is the downstream consequence if the report fails SOC 2 audit review, Series A investor diligence, or an enterprise customer security questionnaire. Asking 12 specific questions on the scoping call separates vendors who deliver audit-acceptable reports from vendors who deliver scanner-output PDFs reformatted as deliverables. This guide walks the 12 questions a Series A SaaS CTO should ask any outsourced pentest vendor in 2026, the green-flag and red-flag patterns in vendor answers, and the buyer-trigger map (compliance / investor / enterprise customer onboarding / fear) each question maps to. For the deliverable format the right answers produce, see the Cybersecify SOC 2 plus ISO 27001 ready pentest report sample.
Key findings
- Outsourced pentest is the right choice for almost every SaaS startup, but vendor selection decides whether the eventual report counts as evidence. Series A and Series B SaaS rarely have the in-house scope volume (12+ engagements per year) that makes hiring an internal pentester economically rational; outsourcing is the structural default.
- 12 questions on the scoping call surface the variables that decide audit acceptance: scope, retest, sample report, named tester, methodology, production vs staging, NDA and data residency, timeline, engagement cost inclusions, post-deliverable audit support, zero-day disclosure protocol, and pricing transparency.
- Four frameworks every credible vendor should name by version: PTES (seven-phase engagement model), OWASP WSTG v5.0 (web app test cases), OWASP API Security Top 10 2023 (API test cases), NIST SP 800-115 (engagement and reporting structure for US auditor recognition).
- One annual external pentest report typically serves SOC 2 + ISO 27001 + DPDP + enterprise customer security questionnaires for 12 months if scope, methodology, tester credentials, and retest evidence are documented per the 12-question framework.
- Indian boutique pentest pricing is roughly 4 to 8 times lower per scope than US boutique pricing for equivalent methodology depth; geography-driven floors are real but the right question is whether the report quality matches the downstream consumer expectation, not which geography is cheapest.
- One free retest within 30 days bundled into the engagement is the industry-acceptable model. Vendors that bill retest separately at 25 to 50 percent of the engagement fee create incentive structures opposite to what the buyer needs.
- Pricing transparency is the cheapest possible vendor honesty signal. Vendors publishing per-scope pricing on the website are operating on scope discipline; vendors quoting only after the scoping call are typically price-discriminating or operating without standard scope.
Cybersecify is a founder-led penetration testing firm based in Bengaluru, India, serving AI-first and API-first SaaS startups from Seed to Series B across India, the UK, the US, the EU, Singapore, Australia, and Hong Kong. Both founders work every engagement: Rathnakara GN (OSCP, CompTIA PenTest+, M.Sc Cyber Security) leads testing; Ashok S Kamat handles scoping, compliance mapping, and post-engagement audit and investor diligence support. The pentest pricing is published at /pricing/: Startup Pentest INR 74,999 (approximately USD 900, GBP 700, EUR 830) for one scope in 7 days; Growth Pentest INR 1,79,999 (approximately USD 2,150, GBP 1,700, EUR 2,000) for two scopes in 10 days with SOC 2 plus ISO 27001 evidence mapping. For the deliverable format, see our SOC 2 plus ISO 27001 ready pentest report sample.
Reading this from outside India? The 12 questions are jurisdiction-agnostic; the vendor-evaluation framework applies identically whether you are buying from a UK, US, EU, Singapore, Australian, or Indian pentest vendor. Pricing references are in INR with USD, GBP, and EUR equivalents below. We invoice in INR per Indian regulation; international clients pay via wire transfer at the prevailing FX rate at time of invoice. GST does not apply on export of services from India (zero-rated). Jurisdiction for any contractual dispute is Bengaluru, India, per Indian Contract Act 1872, non-negotiable across geographies; this is consistent with similar boutique pentest vendors globally who anchor jurisdiction to their incorporation location.
International buyers: USD / GBP / EUR / SGD / AUD / HKD equivalents
Our INR pricing converts approximately as follows (rates as of 2026-06-24):
| Plan | INR | USD | GBP | EUR | SGD | AUD | HKD |
|---|---|---|---|---|---|---|---|
| Startup Pentest | 74,999 | ~900 | ~700 | ~830 | ~1,160 | ~1,330 | ~6,820 |
| Growth Pentest | 1,79,999 | ~2,150 | ~1,700 | ~2,000 | ~2,800 | ~3,200 | ~16,360 |
| Security Retainer (per month) | 24,999 | ~300 | ~230 | ~280 | ~385 | ~440 | ~2,275 |
Approximate conversions calculated 2026-06-24 (1 USD ≈ ₹84, 1 GBP ≈ ₹107, 1 EUR ≈ ₹90, 1 SGD ≈ ₹65, 1 AUD ≈ ₹57, 1 HKD ≈ ₹11). We invoice in INR per Indian regulation; international clients pay via wire transfer at the prevailing FX rate at time of invoice.
Why ask these 12 questions before signing
The buyer of an outsourced pentest engagement is rarely the consumer of the eventual report. The SaaS CTO or founder signs the SOW. The actual consumer is one of four downstream audiences, mapped against the four buyer triggers that drive pentest demand in the first place.
Compliance audit consumer. SOC 2 Type 2 auditor or ISO 27001:2022 certification body reviewer. They read the report for scope coverage against the system description, methodology rigour (named frameworks with versions), tester independence documentation, and retest addendum showing remediation evidence. A report that fails any of those checks triggers an auditor follow-up that delays the audit by 1 to 3 weeks.
Investor diligence consumer. Series A or Series B investor security reviewer (in-house or via a hired diligence firm like Praesidio, Coalfire, Bishop Fox, NCC Group). They read the executive summary for severity counts and trend versus prior reports, then drill into Critical and High findings for exploitability and remediation status. Self-attested or in-house-only reports fail the independence test by construction.
Enterprise customer security review consumer. Enterprise procurement security questionnaire reviewer at a Fortune 500, BFSI buyer, healthcare buyer, or hyperscaler marketplace vendor onboarding team. They want the report itself plus a Letter of Attestation signed by the lead tester confirming testing was completed per scope and methodology. Plan templates and scope documents are increasingly asked for as separate attachments.
Post-breach board response consumer. After a breach in the company stack, a competitor breach in the news cycle, or a board-level security review, the audit committee or post-incident review team needs fresh independent eyes on the system. The report goes to the board; the methodology and scope discipline are what the board’s security advisor reads to assess whether the engagement was thorough.
The 12 questions surface every variable each of the four consumers cares about. A SaaS CTO who walks through all 12 on the scoping call is buying a report that fits all four downstream uses; a CTO who skips half is buying a report that may or may not pass depending on which downstream audience reads it first.
The 12 questions
Question 1: What is actually included in your scope?
The scope statement is the single most-rejected element at downstream audit and investor review. A vendor that cannot answer this question with concrete production assets, user roles, and explicit out-of-scope items is selling scope ambiguity that the buyer will pay for later.
What good answers look like. The vendor enumerates each production URL or API base path tested, each user role exercised (anonymous, regular user, admin, super-admin), each third-party integration boundary clarified (Stripe, Twilio, AWS console, hyperscaler service surfaces), the test environment (production with rate-limited credentials versus staging with production-like data versus dedicated test instance), and the explicit out-of-scope list (DDoS, social engineering, physical access, third-party infrastructure). For a SaaS startup with one web app, one REST API, and a Stripe checkout integration, a good vendor scope statement would say: in scope is https://app.example.com (production web app, all customer-facing routes plus admin console at /admin) and https://api.example.com (production REST API, all v1 endpoints, excluding Stripe webhook endpoints); user roles tested are anonymous, regular user free tier, regular user paid tier, workspace admin, super admin; out of scope is Stripe payment infrastructure, Twilio SMS gateway, AWS console and IAM (separate cloud scope), DDoS or volumetric testing, social engineering, physical access.
Red flags. Vague language like web application security assessment without listing specific production assets, no enumeration of user roles, no explicit out-of-scope list, or scope changes during the engagement without a written change order. If a vendor cannot tell you on the scoping call what they will and will not test, the eventual report will have the same ambiguity, and the auditor or investor reviewer will surface it as a finding against your engagement.
Cybersecify scope discipline. Both Startup Pentest and Growth Pentest engagements include a written scope statement at SOW signature, refined into a per-engagement test plan at kickoff. The Growth Pentest at INR 1,79,999 covers two scopes by default (typically one web app plus one API, or one mobile app plus one API). For the broader scope-design question, see our web application pentest service page, API pentest service page, and cloud pentest service page.
Question 2: How do you handle the retest after fixes?
Retest is the second-most-rejected pentest report element at downstream audit. SOC 2 and ISO 27001 auditors specifically want to see the retest addendum, not just the initial findings list, because the addendum proves remediation worked.
What good answers look like. The vendor includes one retest within a 30-day window from final report delivery, at no additional cost. The retest scope covers all Critical and High findings as the audit-acceptable default, plus Medium and Low findings if the buyer requests and the retest budget allows. The retest depth is full re-exploitation rather than configuration check only; the auditor wants to see that the vulnerability is actually closed, not just that the configuration was changed. The retest deliverable is a separate retest addendum or an appended status table in the original report; both formats are auditor-acceptable, but the vendor should specify which.
Red flags. Retest is billed separately at 25 to 50 percent of the engagement fee, the retest window is shorter than 30 days, retest depth is configuration check only without re-exploitation, or the vendor has no documented retest scope policy and decides per engagement. Vendors that profit from findings staying open across billing cycles have incentive structures opposite to the buyer’s interest.
Cybersecify retest discipline. One free retest within 30 days of final report delivery, bundled into both Startup Pentest at INR 74,999 and Growth Pentest at INR 1,79,999. Retest scope covers all Critical and High findings as default; Medium and Low retest available on request within the same retest cycle. Retest depth is full re-exploitation. Retest deliverable is a separate retest addendum the buyer can hand to the auditor or investor reviewer without further translation. For the broader question of when to schedule a re-pentest beyond the bundled retest cycle, see when to re-pentest your SaaS application.
Question 3: What does your sample report look like?
The sample report is the single most reliable predictor of engagement quality. A vendor that cannot share a redacted sample is hiding the deliverable; a vendor that shares a sample is letting the buyer evaluate quality before paying.
What good answers look like. The vendor shares a full redacted sample report (executive summary, technical findings, evidence appendices, compliance mapping, retest addendum format) either as a downloadable PDF or as a public web page that the buyer can inspect without filling out a lead capture form. The sample report contains the five quality elements documented in the FAQ above: executive summary written for a CTO and a board member, structured per-finding fields, evidence appendices with screenshots and request and response captures, compliance mapping connecting findings to SOC 2 Trust Services Criteria and ISO 27001:2022 Annex A controls, and retest addendum format.
Red flags. The vendor refuses to share a sample, gates the sample behind a lead capture form before any scoping call, shares only an executive summary excerpt without the technical findings, or the sample is a scanner-output PDF with only title and severity fields per finding (no reproduction steps, no business impact, no compliance mapping).
Cybersecify sample report. The full SOC 2 plus ISO 27001 ready sample report is published at /sample-report/ with no lead capture gate. The sample includes redacted technical findings with CVSS v3.1 scoring, reproduction steps, business impact, compliance mapping to SOC 2 TSC and ISO 27001:2022 Annex A, retest addendum format, and the Letter of Attestation template. Buyers can compare this against any other vendor’s sample on equivalent terms. For the broader question of how to read a pentest report once delivered, see how to read a VAPT report.
Question 4: Who is actually doing the testing?
Tester continuity from scoping through testing through reporting through retest is the difference between a credentialed engagement and a sales-handoff engagement. The named lead tester matters because the report is the artifact a downstream consumer reviews; the consumer needs to know who tested, what credentials they hold, and whether they are the same person who signed off on the report.
What good answers look like. The vendor names the lead tester in writing, including their certifications (OSCP, CompTIA PenTest+, CEH, or other recognized pentest certifications relevant to the buyer’s jurisdiction), years of pentest experience, and the engagement role (lead tester scoping plus testing plus reporting plus retest, supported by additional team members on specific test cases). The same lead tester signs the test plan, the final report, and the Letter of Attestation. Founder involvement is documented if the vendor markets founder-led delivery as a differentiator.
Red flags. The vendor will not name the lead tester until kickoff, the salesperson on the scoping call cannot describe the lead tester’s experience, the lead tester changes mid-engagement, or the testing is handed to a junior team member while the senior name appears only on the cover page of the report.
Cybersecify tester continuity. Both founders work every engagement. Rathnakara GN (OSCP, CompTIA PenTest+, M.Sc Cyber Security) leads testing on every Cybersecify engagement and signs the final report and Letter of Attestation. Ashok S Kamat handles scoping, compliance mapping, and post-engagement audit and investor diligence support. The founder-led delivery model is documented at /about/. The lead tester is named in the SOW at signature, not announced at kickoff.
Question 5: What methodology and reporting standard do you follow?
A vendor that cannot name the framework they follow with a version number is either unsure of their own methodology or hiding the fact that they do not have one. Methodology naming is the single cheapest signal of vendor seriousness.
What good answers look like. The vendor names PTES (Penetration Testing Execution Standard) for the seven-phase engagement model, OWASP WSTG v5.0 for web application test cases, OWASP API Security Top 10 2023 edition for API test cases, and NIST SP 800-115 for engagement structure and reporting format. Findings are scored using CVSS v3.1 with the vector string documented per finding so a downstream reviewer can re-derive the score. The reporting standard includes executive summary plus technical findings plus evidence appendices plus compliance mapping plus retest addendum, in that order. See Cybersecify’s methodology page for the full framework reference.
Red flags. Industry best practices without naming a framework, proprietary methodology that the vendor will not document, no CVSS scoring or a non-standard severity rubric (Critical/High/Medium/Low without numeric CVSS attached), or report format that varies per engagement based on what the tester felt like writing.
Cybersecify methodology. PTES seven-phase model plus OWASP WSTG v5.0 plus OWASP API Security Top 10 2023 plus NIST SP 800-115. CVSS v3.1 scoring per finding with vector strings documented. Report format is consistent across engagements. Full methodology reference at /methodology/.
Question 6: How do you handle production versus staging testing?
The production-versus-staging decision affects engagement quality and risk. Production testing finds production-relevant findings but carries data-exposure risk; staging testing carries no production risk but may miss production-specific configuration findings. The right answer is engagement-specific and the vendor should walk through the tradeoffs.
What good answers look like. The vendor asks the buyer about the production data sensitivity, the staging environment fidelity to production, and any regulatory constraints (DPDP Act 2023 reasonable safeguards for India, GDPR Article 32 for EU, UK Data Protection Act 2018 for the UK, Australian Privacy Principles APP 11 for Australia, HIPAA for US healthcare, PCI DSS for payment processors). The vendor then recommends one of three options: production testing with rate-limited credentials and minimal data access for engagements where staging fidelity is low, staging testing with synthetic data for engagements where staging mirrors production faithfully, or a dedicated test instance with no production data exposure for highest-sensitivity scopes. The vendor documents data classes in scope (PII, payment data, healthcare data, business logic data) in the SOW and adapts methodology accordingly.
Red flags. The vendor insists on production testing without discussing data exposure, the vendor insists on staging testing without checking environment fidelity, or the vendor offers no opinion and leaves the decision to the buyer (the buyer is not the methodology expert).
Cybersecify production vs staging discipline. Default for SaaS engagements is production testing with rate-limited credentials, scoped to minimize PII access. Staging testing is the default for engagements where the staging environment mirrors production faithfully (same code version, same configuration, similar data shape) and where production testing carries unacceptable data-exposure risk. Dedicated test instance testing is used for highest-sensitivity scopes (healthcare buyer, BFSI buyer, hyperscaler infrastructure scope). The choice is documented in the SOW and reaffirmed in the test plan at kickoff.
Question 7: What is your NDA and data-residency stance?
International SaaS buyers engaging India-based pentest vendors typically check NDA terms and data-residency claims first. A vendor that has clear documented answers signals operational discipline; a vendor that improvises both signals operational risk.
What good answers look like. The vendor sends a standard mutual NDA at scoping that covers engagement scope, deliverable confidentiality, evidence retention window (typical default is 90 days post final report, longer on request for audit cycles), and sub-contractor disclosure (clearly stating whether any work is sub-contracted and to whom). The NDA names the jurisdiction for any dispute (typical for an Indian boutique is Bengaluru, India, per Indian Contract Act 1872, non-negotiable across geographies; this is consistent with similar vendors globally who anchor jurisdiction to their incorporation location). Data residency claims are verifiable: if the vendor says testing evidence is stored in AWS Mumbai region, the vendor can demonstrate the storage location during the engagement. If the vendor stores evidence on a personal laptop or in a generic cloud bucket without region commitment, that is a risk the buyer should know upfront.
Red flags. The vendor has no standard NDA and asks the buyer to draft one, the vendor signs any NDA the buyer presents without review (signals legal-discipline gaps), the vendor cannot answer where engagement artifacts are stored, the vendor refuses to commit to a retention window, or sub-contracted testers are not disclosed.
Cybersecify NDA discipline. Standard mutual NDA sent at scoping. 90-day retention default post final report; longer retention available on request for audit and investor diligence cycles. Engagement artifacts stored on encrypted vendor-controlled infrastructure with documented region commitment. No sub-contracting; both founders work every engagement. Jurisdiction is Bengaluru, India, per Indian Contract Act 1872, non-negotiable across geographies, per Cybersecify Terms of Service.
Question 8: How fast can you start and finish?
Timeline expectations separate vendors with stable engagement capacity from vendors who over-promise and compress quality under deadline. The realistic timeline for a scope-bounded outsourced pentest engagement is 14 to 21 calendar days end to end.
What good answers look like. The vendor walks the buyer through the realistic phases: 3 to 5 days for scoping and SOW signature, 1 day for kickoff and environment access, 7 to 10 days for active testing (Startup tier 7 days, Growth tier 10 days, additional scopes add 3 to 5 calendar days each), 2 to 3 days for report drafting and internal vendor review, 1 to 2 days for client review and clarification, then retest within 30 days of report delivery. The vendor commits to a kickoff date and a final report delivery date in the SOW, with the test plan refined at kickoff. The vendor does not run rush engagements at a price premium; if the buyer has a hard downstream deadline, the right answer is to start 6 to 8 weeks before the deadline rather than compress the engagement window.
Red flags. The vendor commits to a 3-day or 5-day total engagement window for a multi-scope SaaS application (the deliverable will almost certainly be scanner output), the vendor offers rush pricing at 30 to 50 percent premium for compressed engagements (quality compresses unpredictably), or the vendor cannot commit to a kickoff date until two or three weeks after SOW signature (capacity issue).
Cybersecify timeline discipline. Startup Pentest at INR 74,999: 7 calendar days active testing, 14 days end to end from SOW signature to final report. Growth Pentest at INR 1,79,999: 10 calendar days active testing, 17 to 21 days end to end. Additional scopes add 5 calendar days each (parallel testing available on Growth tier for up to 3 scopes simultaneously, same price). No rush pricing; for buyers with hard downstream deadlines, start 6 to 8 weeks early. Kickoff dates committed in SOW at signature.
Question 9: What does the engagement cost include, and what is extra?
Scope creep on pentest engagements typically manifests as additional charges after the engagement starts: per-vulnerability pricing, per-finding triage fees, retest billed separately, executive presentation as a billable line item, framework-mapping as an upgrade, or post-engagement support charged hourly. A vendor that documents inclusions and exclusions in the SOW saves the buyer the surprise.
What good answers look like. The vendor documents in the SOW everything included in the engagement fee: scope of testing, methodology applied, number of testers, kickoff and status calls, draft and final report, evidence appendices, compliance mapping (if bundled), retest within the 30-day window, and Letter of Attestation (if bundled). The vendor also documents what is explicitly extra: additional scopes beyond the base tier (per-scope pricing), parallel testing to compress timeline (if priced separately), additional retests beyond the bundled one, executive presentation to the buyer’s board (if requested), and post-engagement consulting hours (if not bundled). No surprises in the final invoice.
Red flags. Per-vulnerability pricing (incentivizes report inflation), per-finding triage fees (incentivizes finding inflation), retest billed at 25 to 50 percent of the engagement fee (incentivizes findings staying open), framework-mapping as an upgrade (should be part of the report), or hourly charges for post-engagement clarification.
Cybersecify cost inclusion discipline. Startup Pentest INR 74,999 includes: one scope of testing, PTES plus OWASP WSTG v5.0 plus OWASP API Security Top 10 methodology, kickoff and status calls, draft and final report with executive summary and technical findings, evidence appendices, retest within 30 days, and 6 founder-led consulting hours useable within 6 months from kickoff. Growth Pentest INR 1,79,999 includes: two scopes, same methodology, kickoff and status calls, draft and final report with SOC 2 Trust Services Criteria plus ISO 27001:2022 Annex A mapping per finding, evidence appendices, retest within 30 days, Letter of Attestation, real-world attack simulation, and 12 founder-led consulting hours useable within 12 months from kickoff. Additional scopes priced at INR 74,999 each (+5 calendar days). Additional retests beyond the bundled one priced at INR 25,000 to INR 49,999. Full inclusions documented on the pricing page.
Question 10: Will you support our compliance audit or investor diligence call?
Post-deliverable support is where pentest engagements quietly add value or quietly fail. A vendor whose responsibility ends at report delivery leaves the buyer to defend the report alone in front of the auditor, the investor reviewer, or the enterprise customer security team. A vendor who supports the downstream conversation is materially more useful.
What good answers look like. The vendor commits to one or more of the following: a clarification call with the buyer’s SOC 2 or ISO 27001 auditor to walk through methodology and scope, a clarification call with the investor’s hired security diligence reviewer to walk through findings, a clarification call with the enterprise customer’s security team to respond to questionnaire follow-ups, and consulting hours for the buyer’s engineering team to translate findings into remediation plans. The post-deliverable support is documented in the SOW as included or as available at a documented hourly rate.
Red flags. The vendor’s responsibility ends at report delivery (the buyer is on their own with the auditor), post-deliverable support is billed at a high hourly rate without a documented cap, or the vendor is not available for clarification calls within a reasonable window after delivery.
Cybersecify post-deliverable support. Startup Pentest includes 6 founder-led consulting hours useable within 6 months from kickoff, typically applied to remediation pairing, audit support, or architecture review. Growth Pentest includes 12 founder-led consulting hours useable within 12 months from kickoff, typically applied to SOC 2 or ISO 27001 audit support, investor diligence calls, and enterprise customer security questionnaire response support. For the broader question of SOC 2 audit support specifically, see penetration testing for SOC 2 audit and ISO 27001 vs SOC 2: which first.
Question 11: What happens if you find a critical zero-day mid-engagement?
Zero-day disclosure protocol separates vendors who treat security as a discipline from vendors who treat security as a deliverable. Every credible vendor follows a documented coordinated disclosure flow when a critical zero-day surfaces.
What good answers look like. The vendor walks through the four-step disclosure protocol: (1) immediate pause of further testing on the affected scope and notification to the buyer’s designated security contact through the agreed escalation channel (email plus same-day call), (2) joint assessment of whether the zero-day is first-party (buyer’s code) or third-party (commercial software, open-source library, hyperscaler service), (3) decision on whether the engagement pauses or continues based on whether testing the rest of the scope risks further exploitation of the same vulnerability class, and (4) final report documents the zero-day as a Critical finding with full reproduction steps, with the buyer deciding whether the finding remains in the public-shared version of the report or is redacted (auditor-shared report typically includes the finding; customer-shared report typically redacts technical detail while preserving severity and remediation status). For third-party zero-days, the vendor coordinates with the buyer on disclosure to the upstream vendor, typically following a 90-day coordinated disclosure window.
Red flags. The vendor has no documented disclosure protocol, the vendor would publicly disclose the zero-day without buyer coordination, the vendor would not pause testing on the affected scope, or the vendor has no clear policy on first-party versus third-party finding handling.
Cybersecify disclosure protocol. Documented four-step coordinated disclosure: pause and notify within the same business day, joint first-party versus third-party assessment, pause-or-continue decision, final report with buyer-controlled public versus redacted version. Lead tester (typically Rathnakara GN, OSCP) holds disclosure timeline authority jointly with the buyer’s security owner. No public disclosure without buyer coordination.
Question 12: Do you publish public pricing, or is everything custom?
Pricing transparency is the cheapest possible signal of vendor honesty and operating discipline. A vendor that publishes per-scope pricing on the website with deliverables documented per tier is telling the buyer that scope discipline, deliverable quality, and engagement structure are stable enough to package as a product. A vendor that says all pricing is custom and never quotes until after a scoping call is typically using opaque pricing for one of three reasons.
What good answers look like. The vendor publishes per-scope pricing on the website with deliverables documented per tier. The published pricing includes additional scope pricing, retest inclusion, methodology, and timeline expectations. The scoping call refines the engagement-specific details (production versus staging, test environment access, evidence collection mechanics) but does not change the headline pricing materially. Buyers can compare on equivalent scope across vendors before booking a scoping call.
Red flags. All pricing is custom and never quoted publicly (typically price discrimination based on buyer signals like funding stage or geography, or operating without standard scope discipline), the published pricing does not document deliverables per tier (the buyer cannot compare against another vendor on equivalent terms), or the headline pricing changes materially after the scoping call (anchoring tactic).
Cybersecify pricing transparency. Startup Pentest at INR 74,999 (approximately USD 900, GBP 700, EUR 830) for one scope in 7 calendar days with 6 founder-led consulting hours and one free retest within 30 days. Growth Pentest at INR 1,79,999 (approximately USD 2,150, GBP 1,700, EUR 2,000) for two scopes in 10 calendar days with SOC 2 plus ISO 27001 evidence mapping per finding, Letter of Attestation, 12 founder-led consulting hours, and one free retest within 30 days. Security Retainer at INR 24,999 per month (3-month minimum) for ongoing consulting work with monthly external attack surface scans and Brand Protection scans bundled. Additional scope pricing INR 74,999 each on Growth tier. Full pricing and deliverables documented at /pricing/. For the broader cost question across the Indian pentest market in 2026, see penetration testing cost in India 2026.
What to look for in vendor answers: green flags and red flags
A vendor evaluation table that maps the 12 questions to green-flag and red-flag patterns.
| Question | Green flag | Red flag |
|---|---|---|
| 1. Scope | Enumerated production URLs, user roles, explicit out-of-scope list | Vague “security assessment”, no enumeration, scope changes mid-engagement |
| 2. Retest | Free within 30 days, full re-exploitation, addendum format | Billed at 25 to 50 percent extra, configuration check only, no retest |
| 3. Sample report | Full redacted sample available without lead-capture gate | Refuses to share, gates behind lead form, executive summary only |
| 4. Named tester | Named in SOW, certs documented, signs report and Letter of Attestation | Named at kickoff, salesperson cannot describe, tester changes mid-engagement |
| 5. Methodology | PTES + OWASP WSTG v5.0 + OWASP API Top 10 2023 + NIST SP 800-115 by name | ”Industry best practices”, proprietary methodology, no CVSS v3.1 |
| 6. Production vs staging | Discusses tradeoffs, documents data classes, recommends per engagement | Insists on one option, no opinion, leaves decision to buyer |
| 7. NDA + data residency | Standard mutual NDA, 90-day retention, no sub-contracting, region committed | No standard NDA, signs anything, no retention policy, undisclosed sub-contractors |
| 8. Timeline | 14 to 21 days end to end, kickoff date in SOW, no rush pricing | 3 to 5 day total, rush pricing premium, kickoff slips by weeks |
| 9. Engagement cost inclusions | Everything documented in SOW, additional scopes priced upfront | Per-vulnerability pricing, per-finding triage fees, hidden line items |
| 10. Post-deliverable support | Consulting hours bundled, auditor and investor call support | Responsibility ends at delivery, high hourly post-engagement rate |
| 11. Zero-day disclosure | Documented four-step protocol, buyer-controlled disclosure | No documented protocol, would disclose without coordination |
| 12. Pricing transparency | Public per-tier pricing with deliverables documented | All custom, no public quote, price varies materially after scoping |
A vendor with 10 to 12 green flags is a credible engagement candidate. A vendor with 6 to 9 green flags is worth a deeper scoping call. A vendor with 5 or fewer green flags is a vendor whose report will likely fail downstream audit, investor diligence, or enterprise customer security review. Walk away.
Cybersecify as a vendor: how we answer the 12 questions
Cybersecify is a founder-led penetration testing firm based in Bengaluru, India. Both founders (Ashok S Kamat and Rathnakara GN) work every engagement. We deliver pentest engagements to SaaS startups in India, the UK, the US, the EU, Singapore, Australia, and Hong Kong. The 12 answers above describe how we operate; the /sample-report/ link shows the deliverable. The /pricing/ page documents per-tier pricing with deliverables. The /methodology/ page documents the four-framework methodology stack.
For Series A and Series B SaaS CTOs evaluating outsourced pentest vendors in 2026, the right path is: read the 12 questions, ask them on the scoping call with every vendor on the shortlist, compare answers against the green-flag and red-flag table above, and select the vendor whose answers best match the downstream consumer (SOC 2 auditor, ISO 27001 auditor, Series A investor diligence reviewer, enterprise customer security team). The Cybersecify scoping call typically takes 30 to 45 minutes and walks all 12 questions; book at /book/ or send the scope statement to /contact/.
Related reading
- Should you outsource penetration testing? (the in-house versus outsource decision before vendor selection)
- Penetration test plan example for SaaS startups 2026 (the plan document the selected vendor produces at kickoff)
- Penetration testing cost in India 2026 (the broader India pentest market pricing reference)
- How to evaluate a pentesting firm (broader vendor evaluation framework)
- 5 questions to ask a pentest vendor before signing (the shorter conversation script)
- Penetration testing for SOC 2 audit (the SOC 2 audit consumer view of the report)
- ISO 27001 vs SOC 2: which first (the compliance framework decision)
- How to read a VAPT report (the buyer-side reading of the deliverable)
External authoritative references
- PTES (Penetration Testing Execution Standard) (the seven-phase engagement model)
- OWASP WSTG v5.0 (web app test cases)
- OWASP API Security Top 10 2023 (API test cases)
- NIST SP 800-115 (engagement and reporting structure)
- AICPA Trust Services Criteria (SOC 2 framework)
- ISO/IEC 27001:2022 (ISMS framework, Annex A controls)