Simple, Transparent Pricing

The Startup plan covers 1 scope in 5 business days with a technical + executive report, 6 hours of founder-led consulting, and 1 free retest. The Growth plan covers 2 scopes in 10 business days and adds SOC 2 + ISO 27001 compliance mapping, real-world attack simulation beyond OWASP Top 10, and 12 hours of consulting. Both plans include 1 free retest within one month. Choose Growth if you have a compliance deadline or an enterprise deal in the pipeline. Need ongoing monthly external + brand scans? The Security Retainer bundles 1 external attack surface scan and 1 Brand Protection scan per month plus 10 consulting hours.

Engagement duration (testing + v1.0 report) is fixed per plan and scope count: 5 business days for Startup (1 scope), 10 business days for Growth (2 scopes), and additional scopes beyond the base 2 run in parallel so a 3 or 4 scope engagement still completes in 15 business days. Business days are Monday to Friday; the weekend is our quality buffer and is not counted against the timeline. After v1.0 ships, the retest is scheduled when your team has finished the fixes. Earliest start: as soon as you are ready. Latest start: one month after v1.0 (this is the upper bound on when retest can begin, not a mandatory wait). Retest itself takes 1 to 3 business days, then v2.0 closes the engagement. Faster remediation on your side closes the engagement faster.

The base timeline is 5 business days per scope, run one after another: 1 scope is 5 business days, 2 scopes is 10 business days. From the 3rd scope onward, additional scopes are tested in parallel (up to 3 at a time) at no extra cost, so a 3 or 4 scope engagement still completes in 15 business days instead of stretching to 4 weeks. This parallel-or-sequential choice is a Growth Plan capability, because the Startup Plan caps at 2 scopes. Same fixed price either way. Large estates (5+ scopes) get a custom scoping proposal so we quote a timeline we can staff without cutting testing depth.

Yes, you can add scopes during scoping or after the engagement starts. Startup Plan caps at 2 scopes total (1 base + 1 additional at INR 44,999, with +5 business days = 10 business days total for 2 scopes). Growth Plan has no scope limit (each additional scope at INR 74,999); scopes beyond the base 2 run in parallel, so a 3 or 4 scope engagement completes in 15 business days. Large estates of 5+ scopes get a custom scoping proposal. Adding scopes during the engagement is possible but extends the timeline and requires a scope confirmation note in writing before testing begins on the new scope.

One scope is one application surface tested as a complete unit. Examples: a web application is 1 scope, a REST API is 1 scope, an Android app is 1 scope, an iOS app is 1 scope. Web app + API = 2 scopes (separate surfaces, different attack vectors). iOS + Android = 2 scopes (separate platforms, separate code, separate runtime). A microservices backend with 3 distinct services may count as 1 scope or 3 scopes depending on whether they share authentication and architecture. We confirm scope count during scoping before final pricing. If you are unsure, send us your architecture and we will tell you what we would count as a single scope.

Real-world attack simulation tests beyond the OWASP Top 10 baseline by simulating how a determined attacker would actually compromise your application. This includes chained exploits (using one finding to amplify another), privilege escalation (moving from a regular user to admin), and lateral movement (accessing systems outside the initial entry point). We also test business logic flaws specific to your application such as payment race conditions, IDOR in financial flows, and authorization gaps in tenant-isolated data. Growth Plan includes this because compliance buyers and enterprise customers expect their pentest to demonstrate not just OWASP coverage but that the application can withstand a focused attacker. Startup Plan covers OWASP Top 10 + PTES standard methodology, sufficient for buyers without active enterprise or audit pressure.

Each finding in the Growth Plan report is mapped to specific control requirements in two frameworks. SOC 2 mapping covers the Trust Services Criteria 2017, typically CC6.1 (logical access security), CC6.3 (role-based access), CC6.6 (system boundaries), CC7.2 (monitoring), and CC8.1 (change management) for a typical web or API engagement. ISO 27001 mapping covers Annex A controls, typically A.9 (access control), A.13 (communications security), A.14 (system acquisition, development, and maintenance), and A.12.4 (event logging). The compliance evidence package is delivered as a separate section of the report and can be handed to your auditor as direct evidence of penetration testing, findings, and remediation. Useful for SOC 2 Type 1, SOC 2 Type 2, and ISO 27001 internal or external audits.

No. Pentest plans are pentest + retest + consulting hours only. If you want monthly external attack surface scans (subdomains, exposed services, certs, DNS posture, mail security) and Brand Protection scans (typosquatting, leaked credentials, fake apps, phishing infrastructure), these are bundled with the Security Retainer (INR 24,999/month, 3-month minimum). The Retainer includes 1 external attack surface scan + 1 Brand Protection scan per month, plus 10 hours of founder-led consulting per month.

Startup Plan: 6 hours of founder-led security consulting. Growth Plan: 12 hours. Use these hours during the engagement (scope clarification, remediation pairing) or anytime in the 6-month or 12-month consulting window (architecture review, compliance prep, threat modeling, incident readiness). Both founders available. Need more? The Security Retainer (INR 24,999/month, 10 hours/month, 3-month minimum) is the next step up.

Cybersecify offers penetration testing starting at INR 74,999 for a single scope (web, API, Android, iOS, cloud, or IoT) with delivery in 5 business days. The Startup Plan includes 6 consulting hours and 1 free retest. The Growth Plan at INR 1,79,999 includes 2 scopes, 10 business days, SOC 2 + ISO 27001 compliance evidence, real-world attack simulation, 12 consulting hours, and 1 free retest. All prices exclude taxes. Monthly external attack surface + Brand Protection scans are bundled with the Security Retainer (INR 24,999/month, 3-month minimum), not with the pentest plans.

Yes. We publish a full redacted sample showing the exact structure, finding format, compliance mapping, and methodology you receive. You can view it online or download it as a PDF. View sample report →