Simple, Transparent Pricing

The Startup plan covers 1 scope in 7 days with a technical report, executive summary, free retest, and Brand Protection Snapshot. The Growth plan covers 2 scopes in 10 days and adds SOC 2 + ISO 27001 compliance mapping, a second sanity retest, and real-world attack simulation beyond OWASP Top 10. Choose Growth if you have a compliance deadline or an enterprise deal in the pipeline.

Startup engagements run 7 calendar days from kickoff to v1.0 initial report (or 10 days for 2 scopes). After v1.0, you have a remediation window of 30 calendar days before our retest. The retest itself takes 1 to 3 business days, after which the report is closed. Total worst case: roughly 37 to 40 calendar days. Growth engagements run 10 calendar days to v1.0 (2 base scopes), then a remediation window of 30 calendar days before the full retest, then a window of 15 calendar days before the sanity retest. Each retest takes 1 to 3 business days. Total worst case: roughly 55 to 60 calendar days. If your team remediates faster, the engagement closes faster. These are upper bounds, not minimums.

For Growth Plan engagements with additional scopes (3rd scope onwards), you can choose parallel or sequential testing at no extra cost. Parallel means scopes are tested simultaneously, compressing the total delivery window. Sequential means scopes are tested one at a time, lighter coordination on your team's side. Same fixed price either way. Parallel testing is recommended for engagements up to 3 scopes simultaneously; larger engagements (4+) run hybrid or sequential by default to maintain testing depth. The base 2 scopes on Growth are always tested in parallel within the published delivery window. That is the floor, not a choice.

Yes, you can add scopes during scoping or after the engagement starts. Startup Plan caps at 2 scopes total (1 base + 1 additional at INR 44,999, with +3 calendar days = 10 days total for 2 scopes). Growth Plan has no scope limit (each additional scope at INR 74,999, with +5 calendar days). For 3+ scope engagements on Growth, you can choose parallel testing to compress the timeline. Adding scopes during the engagement is possible but extends the calendar days and requires a scope confirmation note in writing before testing begins on the new scope.

Growth Plan includes 2 retests on a structured cadence. The full retest happens within 30 calendar days of v1.0, after your first round of remediation. We retest every finding to verify fixes. The sanity retest happens within 15 calendar days of the full retest, after any final tweaks (typically the 1 to 2 findings still open after the first retest). Together, they close the report with all findings marked Remediated, Risk Accepted, or Compensating Controls in Place. Startup Plan includes 1 retest within the same 30 calendar day cadence, sufficient for single scope engagements where a single round of fixes typically closes everything cleanly.

One scope is one application surface tested as a complete unit. Examples: a web application is 1 scope, a REST API is 1 scope, an Android app is 1 scope, an iOS app is 1 scope. Web app + API = 2 scopes (separate surfaces, different attack vectors). iOS + Android = 2 scopes (separate platforms, separate code, separate runtime). A microservices backend with 3 distinct services may count as 1 scope or 3 scopes depending on whether they share authentication and architecture. We confirm scope count during scoping before final pricing. If you are unsure, send us your architecture and we will tell you what we would count as a single scope.

Real-world attack simulation tests beyond the OWASP Top 10 baseline by simulating how a determined attacker would actually compromise your application. This includes chained exploits (using one finding to amplify another), privilege escalation (moving from a regular user to admin), and lateral movement (accessing systems outside the initial entry point). We also test business logic flaws specific to your application such as payment race conditions, IDOR in financial flows, and authorization gaps in tenant-isolated data. Growth Plan includes this because compliance buyers and enterprise customers expect their pentest to demonstrate not just OWASP coverage but that the application can withstand a focused attacker. Startup Plan covers OWASP Top 10 + PTES standard methodology, sufficient for buyers without active enterprise or audit pressure.

Each finding in the Growth Plan report is mapped to specific control requirements in two frameworks. SOC 2 mapping covers the Trust Services Criteria 2017, typically CC6.1 (logical access security), CC6.3 (role-based access), CC6.6 (system boundaries), CC7.2 (monitoring), and CC8.1 (change management) for a typical web or API engagement. ISO 27001 mapping covers Annex A controls, typically A.9 (access control), A.13 (communications security), A.14 (system acquisition, development, and maintenance), and A.12.4 (event logging). The compliance evidence package is delivered as a separate section of the report and can be handed to your auditor as direct evidence of penetration testing, findings, and remediation. Useful for SOC 2 Type 1, SOC 2 Type 2, and ISO 27001 internal or external audits.

During the discovery phase of every pentest, we check for typosquatting domains, fake mobile apps impersonating your brand, leaked credentials on the dark web, code exposure on public repos, and phishing infrastructure targeting your company. Included with both pentest plans at no extra cost. See it in our sample report →

Cyber Secify offers penetration testing starting at INR 74,999 for a single scope (web, API, Android, iOS, cloud, or IoT) with delivery in 7 calendar days. The Growth Plan at INR 1,79,999 includes 2 scopes, delivery in 10 calendar days, compliance evidence, and 2 retests. All prices exclude taxes.

Yes. We publish a full redacted sample showing the exact structure, finding format, compliance mapping, and Brand Protection Snapshot you receive. You can view it online or download it as a PDF. View sample report →