Pentest Pricing

The Essentials Plan covers 1 scope in 6 business days with a technical + executive report, 6 hours of founder-led consulting, and 1 free retest. The Compliance Plan covers 2 scopes in 12 business days and adds systematic OWASP WSTG v4.2 test-case coverage, SOC 2 + ISO 27001 compliance mapping, real-world attack simulation beyond OWASP Top 10, and 12 hours of consulting. Both plans include 1 free retest within one month. Choose the Compliance Plan if you have a compliance deadline or an enterprise deal in the pipeline.

Engagement duration (testing + v1.0 report) depends on plan and scope count: 6 business days on the Essentials Plan (1 scope), 12 business days on the Compliance Plan (2 scopes). A scope is 6 business days, 5 days of testing and 1 day writing the report, so the report is produced inside the window rather than after it. For larger estates we confirm the schedule when we scope the work with you. Business days are Monday to Friday; the weekend is our quality buffer and is not counted against the timeline. After v1.0 ships, the retest is scheduled when your team has finished the fixes. Earliest start: as soon as you are ready. Latest start: one month after v1.0 (this is the upper bound on when retest can begin, not a mandatory wait). Retest itself takes 1 to 3 business days, then v2.0 closes the engagement. Faster remediation on your side closes the engagement faster.

Yes, you can add scopes during scoping or after the engagement starts. Neither plan caps the number of scopes. On the Essentials Plan each additional scope is INR 44,999; on the Compliance Plan each additional scope is INR 74,999. A scope is 6 business days, 5 days of testing and 1 day writing the report. For more than two scopes we confirm the schedule when we scope the work. Adding scopes during the engagement is possible but extends the timeline and requires a scope confirmation note in writing before testing begins on the new scope.

One scope is one application surface tested as a complete unit. Examples: a web application is 1 scope, a REST API is 1 scope, an Android app is 1 scope, an iOS app is 1 scope. Web app + API = 2 scopes (separate surfaces, different attack vectors). iOS + Android = 2 scopes (separate platforms, separate code, separate runtime). A microservices backend with 3 distinct services may count as 1 scope or 3 scopes depending on whether they share authentication and architecture. We confirm scope count during scoping before final pricing. If you are unsure, send us your architecture and we will tell you what we would count as a single scope.

Indian buyers are charged GST on top of the INR price. Export of services is a zero-rated supply under Indian GST, and we supply under a Letter of Undertaking, so no Indian GST is added outside India. Any tax due in your own country remains yours to account for. The INR price is the one that binds. USD and EUR figures on this page are indicative, converted at roughly INR 95 to the dollar and INR 110 to the euro as at August 2026, and international engagements are invoiced at the rate on the date of your quote.

Real-world attack simulation tests beyond the OWASP Top 10 baseline by simulating how a determined attacker would actually compromise your application. This includes chained exploits (using one finding to amplify another), privilege escalation (moving from a regular user to admin), and lateral movement (accessing systems outside the initial entry point). We also test business logic flaws specific to your application such as payment race conditions, IDOR in financial flows, and authorization gaps in tenant-isolated data. The Compliance Plan includes this because a certificate puts an auditor on the other side of the report, and an audit expects evidence the application withstood a focused attacker rather than only that the OWASP categories were covered. The Essentials Plan covers OWASP Top 10:2025 + PTES, which is what an enterprise customer, an investor or an acquirer evaluating you is asking to see.

Each finding in the Compliance Plan report is mapped to specific control requirements in two frameworks. SOC 2 mapping covers the Trust Services Criteria 2017, typically CC6.1 (logical access security), CC6.3 (role-based access), CC6.6 (protection against external threats), CC7.2 (monitoring), and CC8.1 (change management) for a typical web or API engagement. Separately from the per-finding mapping, the engagement itself is evidence for CC4.1, which calls for ongoing and/or separate evaluations: an external test by a party with no role in building or running the systems is the separate half of that criterion. ISO 27001 mapping covers Annex A controls from the 2022 revision, typically A.5.15 and A.8.3 (access control), A.8.20 to A.8.23 (network and communications security), A.8.25 to A.8.29 (secure development and testing), and A.8.15 (logging). The compliance evidence package is delivered as a separate section of the report and can be handed to your auditor as direct evidence of penetration testing, findings, and remediation. Useful for SOC 2 Type 1, SOC 2 Type 2, and ISO 27001 internal or external audits.

Essentials Plan: 6 hours of founder-led security consulting. Compliance Plan: 12 hours of founder-led security consulting. Use these hours during the engagement (scope clarification, remediation pairing) or anytime in the 6-month or 12-month consulting window (architecture review, compliance prep, threat modeling, incident readiness). Both founders are available. Hours do not roll over but typically get fully used.

Cybersecify offers penetration testing starting at INR 74,999 for a single scope (AI, web app, API, Android, iOS, desktop, cloud, IoT, internal network, or external network) with delivery in 6 business days. The Essentials Plan includes 6 consulting hours and 1 free retest. The Compliance Plan at INR 1,79,999 includes 2 scopes, 12 business days, SOC 2 + ISO 27001 compliance evidence, real-world attack simulation, 12 consulting hours, and 1 free retest. All prices exclude taxes.

Cybersecify publishes its prices in full rather than quoting only after a call. The Essentials Plan is INR 74,999 for one scope in 6 business days; the Compliance Plan is INR 1,79,999 for two scopes in 12 business days and adds SOC 2 and ISO 27001 evidence mapping. Both include one free retest. Prices exclude taxes, the scope picker on this page gives you a figure before you contact us, and a full sample report is public.

Yes. We publish a full redacted sample showing the exact structure, finding format, compliance mapping, and methodology you receive. You can view it online or download it as a PDF. View sample report →

Nothing is invoiced until the scope is agreed in writing, and the binding number comes last, not first. Before a proforma invoice exists you have had a response to your inquiry, a non-binding estimate, a mutual NDA signed by both parties, a walkthrough of your product, with test credentials and access verification to confirm what is actually there, a formal quote issued against that confirmed scope and approved by you, and a SOW signed by an authorised signatory on both sides setting out the exact scopes you picked, the timeline and the deliverables. The estimate can move in either direction once we have looked: two surfaces may fit inside one scope, or something may need a scope of its own. Once the SOW is signed, nothing moves. You are approving a document you have read, not a description on a web page. The advance confirms the testing slot, which is capped at six pentests a month because both founders work every engagement. The remaining 50% falls due after the v1.0 report is delivered, so the findings are in your hands before we are paid in full. Both sides are exposed for half, and neither is asked to extend trust the other has not already matched.

No, and that is a pricing decision rather than an oversight. Carrying it would raise the price of every engagement, including the many where nobody asks. What limits your exposure is written into the documents you sign: a mutual liability cap at the fees you have paid, with refund as the maximum remedy; written authorisation to test, scoped in the SOW, which is what makes the engagement lawful; a named out of scope list, so nothing is tested that you did not agree to; encrypted handling of evidence with written confirmation when it is deleted; a rework or refund commitment if delivery misses the SOW; and a clause protecting the integrity of findings, so nobody can lean on us to soften one. If your procurement mandates professional indemnity cover, tell us at scoping and we will quote it as a custom engagement rather than pretend the standard one includes it. Full terms are in the RFP template.