Simple, Transparent Pricing

The Startup plan covers 1 scope in 7 calendar days with a technical + executive report, 6 hours of founder-led consulting, and 1 free retest. The Growth plan covers 2 scopes in 10 calendar days and adds SOC 2 + ISO 27001 compliance mapping, real-world attack simulation beyond OWASP Top 10, and 12 hours of consulting. Both plans include 1 free retest within 30 calendar days. Choose Growth if you have a compliance deadline or an enterprise deal in the pipeline. Need ongoing monthly external + brand scans? The Security Retainer bundles 1 external attack surface scan and 1 Brand Protection scan per month plus 10 consulting hours.

Engagement duration (testing + v1.0 report) is fixed per plan and scope count: 7 calendar days for Startup (1 scope), 10 calendar days for Growth (2 scopes), +3 days per additional scope. After v1.0 ships, the retest is scheduled when your team has finished the fixes. Earliest start: as soon as you are ready. Latest start: 30 calendar days after v1.0 (this is the upper bound on when retest can begin, not a mandatory wait). Retest itself takes 1 to 3 business days, then v2.0 closes the engagement. Faster remediation on your side closes the engagement faster.

For Growth Plan engagements with additional scopes (3rd scope onwards), you can choose parallel or sequential testing at no extra cost. Parallel means scopes are tested simultaneously, compressing the total delivery window. Sequential means scopes are tested one at a time, lighter coordination on your team's side. Same fixed price either way. Parallel testing is recommended for engagements up to 3 scopes simultaneously; larger engagements (4+) run hybrid or sequential by default to maintain testing depth. The base 2 scopes on Growth are always tested in parallel within the published delivery window. That is the floor, not a choice.

Yes, you can add scopes during scoping or after the engagement starts. Startup Plan caps at 2 scopes total (1 base + 1 additional at INR 44,999, with +3 calendar days = 10 days total for 2 scopes). Growth Plan has no scope limit (each additional scope at INR 74,999, with +5 calendar days). For 3+ scope engagements on Growth, you can choose parallel testing to compress the timeline. Adding scopes during the engagement is possible but extends the calendar days and requires a scope confirmation note in writing before testing begins on the new scope.

One scope is one application surface tested as a complete unit. Examples: a web application is 1 scope, a REST API is 1 scope, an Android app is 1 scope, an iOS app is 1 scope. Web app + API = 2 scopes (separate surfaces, different attack vectors). iOS + Android = 2 scopes (separate platforms, separate code, separate runtime). A microservices backend with 3 distinct services may count as 1 scope or 3 scopes depending on whether they share authentication and architecture. We confirm scope count during scoping before final pricing. If you are unsure, send us your architecture and we will tell you what we would count as a single scope.

Real-world attack simulation tests beyond the OWASP Top 10 baseline by simulating how a determined attacker would actually compromise your application. This includes chained exploits (using one finding to amplify another), privilege escalation (moving from a regular user to admin), and lateral movement (accessing systems outside the initial entry point). We also test business logic flaws specific to your application such as payment race conditions, IDOR in financial flows, and authorization gaps in tenant-isolated data. Growth Plan includes this because compliance buyers and enterprise customers expect their pentest to demonstrate not just OWASP coverage but that the application can withstand a focused attacker. Startup Plan covers OWASP Top 10 + PTES standard methodology, sufficient for buyers without active enterprise or audit pressure.

Each finding in the Growth Plan report is mapped to specific control requirements in two frameworks. SOC 2 mapping covers the Trust Services Criteria 2017, typically CC6.1 (logical access security), CC6.3 (role-based access), CC6.6 (system boundaries), CC7.2 (monitoring), and CC8.1 (change management) for a typical web or API engagement. ISO 27001 mapping covers Annex A controls, typically A.9 (access control), A.13 (communications security), A.14 (system acquisition, development, and maintenance), and A.12.4 (event logging). The compliance evidence package is delivered as a separate section of the report and can be handed to your auditor as direct evidence of penetration testing, findings, and remediation. Useful for SOC 2 Type 1, SOC 2 Type 2, and ISO 27001 internal or external audits.

No. Pentest plans are pentest + retest + consulting hours only. If you want monthly external attack surface scans (subdomains, exposed services, certs, DNS posture, mail security) and Brand Protection scans (typosquatting, leaked credentials, fake apps, phishing infrastructure), these are bundled with the Security Retainer (INR 24,999/month, 3-month minimum). The Retainer includes 1 external attack surface scan + 1 Brand Protection scan per month, plus 10 hours of founder-led consulting per month.

Startup Plan: 6 hours of founder-led security consulting. Growth Plan: 12 hours. Use these hours during the engagement (scope clarification, remediation pairing) or anytime in the 6-month or 12-month consulting window (architecture review, compliance prep, threat modeling, incident readiness). Both founders available. Need more? The Security Retainer (INR 24,999/month, 10 hours/month, 3-month minimum) is the next step up.

Cybersecify offers penetration testing starting at INR 74,999 for a single scope (web, API, Android, iOS, cloud, or IoT) with delivery in 7 calendar days. The Startup Plan includes 6 consulting hours and 1 free retest. The Growth Plan at INR 1,79,999 includes 2 scopes, 10 calendar days, SOC 2 + ISO 27001 compliance evidence, real-world attack simulation, 12 consulting hours, and 1 free retest. All prices exclude taxes. Monthly external attack surface + Brand Protection scans are bundled with the Security Retainer (INR 24,999/month, 3-month minimum), not with the pentest plans.

Yes. We publish a full redacted sample showing the exact structure, finding format, compliance mapping, and methodology you receive. You can view it online or download it as a PDF. View sample report →