Engagements
and rates.

We publish our rates so you can plan a budget without a sales process. Every engagement is fixed-scope and fixed-price, agreed in writing before work begins, and includes the full report, a signed attestation letter and a remediation re-test.

See the packages Book a 30-min scoping call

Start at $0

Free external attack-surface snapshot

Public data only, no access needed, nothing touched. A short PDF with your top exposures and a risk rating within 2–3 business days. Keep it even if you never hire us.

Get the free snapshot

Engagements

Every one includes the full report, the signed attestation letter, a free re-test and a walkthrough call. Nothing below is a subscription you have to cancel.

Launch Pentest

Your first real pentest. One web app or API, the OWASP Top 10 and the authentication logic around it.

$1,499
flat · 5 business days
  • 1 web app or 1 API, up to 30 endpoints
  • Up to 2 user roles tested
  • OWASP Top 10 + auth & session logic
  • Full report + signed attestation letter
  • One free re-test after you patch
  • 45-minute walkthrough call
Book a scoping call
Most Popular

Web & API Pentest

The engagement auditors and enterprise buyers expect. Business logic, multi-tenant access control, cloud config.

$2,500
fixed · 1–2 weeks
  • 1 app + its API, up to 100 endpoints
  • All user roles & tenant-isolation testing
  • Business logic, IDOR & privilege escalation
  • AWS/GCP misconfiguration review
  • Everything in Launch, plus a preliminary alert on any critical finding
  • One free re-test + walkthrough call
Book a scoping call

AI / LLM Red Team

For teams shipping an LLM feature, autonomous agent or RAG pipeline into production.

$3,500
fixed · 2–3 weeks
  • Prompt injection, direct and indirect
  • Jailbreaks & safeguard bypass
  • Tool/agent abuse and over-permissioned actions
  • RAG poisoning & context leakage
  • PII and training-data extraction
  • Mapped to MITRE ATLAS + OWASP LLM Top 10
  • Guardrail hardening guidance you can implement
Book a scoping call

Continuous

For teams that ship weekly and don't want their security evidence to be a year out of date by March.

$600/mo
from · cancel anytime
  • Monthly external attack-surface recon
  • One deep test per quarter
  • Unlimited re-tests
  • Shared Slack or Discord channel
  • Priority disclosure if we spot something
  • Attestation letter refreshed each quarter
Book a scoping call

Scoped in writing. A one-page scope and a fixed quote within 24 hours of the call, before any commitment.

Half up front, half on delivery. Bank transfer, card or UPI. Invoices in USD, EUR, GBP or INR.

No lock-in. No auto-renew, no minimum term, no per-seat platform fee stacked on top of the test.

In every engagement

What the price includes

No deliverable is an upsell. If it's on this list, it's in the number you see above — including the re-test that most firms charge for separately.

Read a redacted sample report
  • Manual, human testing — scanners are a starting point, never the deliverable
  • Executive summary written for a non-technical reader
  • Every finding with reproduction steps, the raw request and proof
  • CVSS 3.1 score plus a plain-English statement of real impact
  • Concrete remediation advice in your stack's language
  • Signed attestation letter for auditors and customer security reviews
  • One free re-test and an updated report showing findings closed
  • 45-minute walkthrough call with the engineer who ran the test
  • Findings filed into Jira, Linear or GitHub Issues on request
  • Mutual NDA, written fixed scope, and all artefacts wiped on completion

What moves the number

So you can estimate before you talk to us, and so nothing in the quote is a surprise.

How many apps and APIs

One product with one API is the baseline. Each extra application, admin panel or public API adds scope.

Endpoint count

Roughly how many distinct routes or operations exist. 30 is a small product; 300 is a platform.

User roles and tenancy

Every role multiplies the access-control testing. Multi-tenant SaaS needs isolation testing between tenants.

Authentication complexity

SSO, SAML, OAuth flows, MFA and API-key schemes each need separate attention.

Black box or white box

Source access makes us faster and more thorough. It costs a little more and finds a lot more.

How fast you need it

Standard slots open within about a week. A 72-hour turnaround means we move other work.

Add-ons

Published too. Added to the quote before you sign, never to the invoice afterwards.

Each additional web app or API in the same engagement +$900
Mobile application (Android or iOS) +$1,200
Source-code-assisted (white-box) testing +$600
Internal network testing over VPN +$1,200
Thick-client / desktop application from $1,500
Rush delivery (report in 72 hours) +30%
Extra re-test beyond the free one $400
Report re-written to your auditor's required format Free
Walkthrough call with your customer's security team Free

From first email to fixed quote

Usually 24 hours. There is no procurement dance and no second call with a different person.

01

You tell us the shape

A 30-minute call, or just an email describing your app, roles and rough endpoint count.

02

Fixed quote in writing

Within 24 hours: one page, one price, the exact scope and the start date.

03

NDA and scope signed

Mutual NDA, signed scope, staging access with a test account per role. Then we start.

04

Report, call, re-test

Report and attestation letter, a walkthrough call, then a free re-test when you've patched.

Common questions

Is the price really fixed?
The engineers on your scoping call. Nothing is subcontracted to a freelancer marketplace, and no finding in your report is auto-generated from a scanner. Each report is independently reproduced by a second engineer before it is issued, so every reproduction step has been followed by someone other than the person who wrote it.
How do you arrive at a number?
From the scope, not from your funding stage. On the call we establish how many applications and APIs are in play, how many user roles and tenancy boundaries exist, how complex your authentication is, and whether we work black box or with source access. That gives us the engineer-days, and the engineer-days give us the price. You get it in writing within 24 hours and it does not move afterwards.
Who actually performs the testing?
The engineers on your scoping call. Nothing is subcontracted to a freelancer marketplace, and no finding in your report is auto-generated from a scanner. Every report is independently reproduced by a second engineer before it is issued, so each reproduction step has been followed by someone other than its author.
What if you find nothing serious?
You get a report stating exactly that, with the full inventory of what was tested and how — which is precisely the evidence an auditor or an enterprise customer is asking for. We will not inflate informational findings into criticals to justify an invoice.
Do you charge for the re-test?
No. One re-test after you patch is included in every engagement, along with an updated report showing the findings closed. Additional re-tests are $400 each, and they're unlimited on the Continuous plan.
How do we pay, and in what currency?
Half on signature, half on delivery of the report. Bank transfer, card or UPI. We invoice in USD, EUR, GBP or INR — Indian clients are billed in INR with GST.
Do you have a discount for early-stage startups?
We scope to what the product actually needs rather than to a company's stage, which usually matters more than a discount. Where budget is the constraint we will tell you the smallest engagement that genuinely answers your question — sometimes that is the free attack-surface snapshot.
How quickly can you start?
Standard slots usually open within a week of the scoping call. We need a mutual NDA, a signed one-page scope and a staging environment with test accounts for each role. Rush delivery is available at +30%.

Not sure which one you need?

Tell us what you're building and we'll tell you the smallest engagement that actually answers your question — even when that's the free snapshot.

Book a 30-min scoping call Email us instead

We reply within 24 hours · NDA on request · No sales sequence