Search is unavailable right now. Try again in a moment.
One scan is $500, and one scan is one application or one target. The paid trial is $299. Past a single target the number depends on what you own, so a scoping call sends back a written scope with a price against it.
The two prices
Penetration testing pricing here is two figures and a scoping call. Request a $299 trial or a $500 single-target scan. We’ll confirm the scope and authorisation before testing begins.
| Price | What it buys | What that means |
|---|---|---|
| $500 | One scan of one application or one target | The whole run: discovery, planning, scanning, exploitation, reporting, and a QA pass that works on the finished report before it reaches you. Every finding arrives with the request that produced it, the response that came back, the steps to reproduce it, a CVSS v4.0 vector and the CWE. |
| Request a $500 single-target scan. We’ll confirm the scope and authorisation before testing begins. A second application is a second scan. | ||
| $299 | The paid trial | One scan of one target, requested the same way: we’ll confirm the scope and authorisation, arrange payment, and get the assessment underway. A free trial exists as well and is a different thing: it is sales qualified, so it begins with a conversation. |
| The paid trial is the cheaper way to read a finished B-52 report against something you own before committing an estate to it. | ||
Request a $500 single-target scan. We’ll confirm the scope and authorisation before testing begins. A second application is a second scan.
The paid trial is the cheaper way to read a finished B-52 report against something you own before committing an estate to it.
What one scan covers (the six phases, the QA pass that runs on the finished report before it reaches you, and what arrives attached to each finding) is set out on what a scan covers. The trial has its own page at the $299 trial.
Coverage
B-52 accepts single-target assessment requests for five of the eleven coverage classes: the application ones. For broader scopes or the other six, an engineer will work with you on a tailored assessment plan, because what goes into the scope has to be settled before a run can start.
| Coverage class | How it is bought | What is being scoped |
|---|---|---|
| Web applications | Request a scan | One application. We need a credential for each role it defines, because access control and business logic can only be tested from inside them. |
| Mobile apps | Request a scan | One signed release build, exactly as you publish it. We work from the binary, so obfuscation and certificate pinning stay where they are. |
| APIs | Request a scan | One API, with its authorisation matrix agreed before testing starts. |
| Thick client | Request a scan | The package you distribute, plus the server behind it. A check removed from the client only matters if the server skipped it too. |
| Secure code review | Request a scan | The codebase you point us at. Findings name the file, the line, and the path that reaches it. |
| External network | Scoped engagement | Your perimeter as it responds on the day. The scope proposal comes back with a target count, which is usually the number in dispute. |
| Internal network | Scoped engagement | A deployed position inside your network, and a movement boundary written into the scope before the run starts. |
| The one class where something is deployed inside your network. External and application testing needs nothing deployed at all. | ||
| Cloud | Scoped engagement | The identity and permission layer of one tenancy, with every permission proved by making the call. |
| Active Directory | Scoped engagement | One directory, and the privilege paths across it. We report the paths that held alongside the ones that did not. |
| Social engineering | Scoped engagement | A written authorisation naming the population and the window. Nothing goes out before you have signed it. |
| LLM applications | Scoped engagement | The application around the model: what it retrieves, what it renders, and which tools it can be made to invoke. |
The one class where something is deployed inside your network. External and application testing needs nothing deployed at all.
Where that one deployment is needed, it runs on-premise or inside your own cloud tenancy: deployment and residency sets out the four regions your data can sit in, and you choose which.
Every class links to its own page, and each of those states the defect classes it works, the standards it aligns to at their current versions, and what is fixed before a run begins. The coverage index holds all eleven together.
Scoping
Past one target, the number moves along four axes. Here is what each one is, what to have ready for it, and what it decides, so the call starts at the third question.
Coverage is identical in all three delivery models, so axis three is a decision about assurance and not about testing. The delivery models page sets out which one answers which need, and CERT-In empanelment is the instrument behind the two that carry a signature.
Where the cadence is the pipeline itself, the build gate describes the threshold you set and what happens at or above it, and the integrations index covers the four systems the step runs in.
Axis four is set out option by option on how we handle your data, and the option you choose is written into your agreement at §3.12 of the DPA.
The scoping call
There are two shapes of pentest pricing question: what does one application cost, and what does our estate cost. The first is answered further up this page. This is how the second gets answered.
| Step | What happens | In practice |
|---|---|---|
| 1 | You send the scope | The applications, APIs, ranges and tenancies you want covered, and what the output has to survive. We work out how many targets that is, because one scan is one application or one target. |
| 2 | We name the delivery model | If the report ends in a regulated filing, that decision is made for you: the auditor who signs it has to have been inside the engagement. |
| 3 | A written scope comes back | What a run would cover, and what it costs. The number is written against the estate you sent, so there is nothing left for you to work out at your end. |
| 4 | A call, only if it needs one | If the written scope answers the question, you already have the answer. If it raises one, we suggest times. |
1
2
3
4
One to three business days is the observed median from scope sign-off to report, and that figure belongs to the fully autonomous model. A median is not a service level, and nothing in a scope turns it into one.
If you would rather see a finished report before sending an estate, a walkthrough goes through a completed run screen by screen, and the $299 trial puts one against something you own.
What is on the page
B-52 publishes clear entry pricing: $299 for a paid trial and $500 for a single-target scan. Across the seven platforms in the comparison set this site tracks, pricing takes more than one form: some publish list prices, and others price by quote or through procurement agreements a buyer already holds.
What any of the seven charges is not restated here. Where a vendor publishes a figure, its comparison page quotes it with the page it was read on and the date. What is ours to state is the figure at the top of this page. It is on the page with no form in front of it, and you can hold any quote you receive against it.
Deliberately excluded
Request a $299 trial or a $500 single-target scan. We’ll confirm the scope and authorisation before testing begins. Past a single target, send the scope and a written recommendation comes back with a price written against it.