One scan is $500, and one scan is one application or one target. The paid trial is $299. Past a single target the number depends on what you own, so a scoping call sends back a written scope with a price against it.
The two prices
Penetration testing pricing here is two figures and a scoping call. Both figures take a card, and neither of them takes a conversation first.
| Price | What it buys | What that means |
|---|---|---|
| $500 | One scan of one application or one target | The whole run: discovery, planning, scanning, exploitation, reporting, and a QA pass that works on the finished report before it reaches you. Every finding arrives with the request that produced it, the response that came back, the steps to reproduce it, a CVSS v4.0 vector and the CWE. |
| Card payment on the self-serve flow, with no sales conversation in front of it. A second application is a second scan. | ||
| $299 | The paid trial | One scan of one target, bought with a card on the same self-serve flow. A free trial exists as well and is a different thing: it is sales qualified, so it begins with a conversation rather than with a card. |
| The paid trial is the cheaper way to read a finished B-52 report against something you own before committing an estate to it. | ||
Card payment on the self-serve flow, with no sales conversation in front of it. A second application is a second scan.
The paid trial is the cheaper way to read a finished B-52 report against something you own before committing an estate to it.
What one scan covers — the six phases, the QA pass that runs on the finished report before it reaches you, and what arrives attached to each finding — is set out on what a scan covers . The trial has its own page at the $299 trial.
Coverage
The self-serve flow reaches five of the eleven coverage classes — the application ones. The other six begin with a scoping call, because what goes into the scope has to be settled before a run can start.
| Coverage class | How it is bought | What is being scoped |
|---|---|---|
| Web applications | Card, self-serve | One application, with a credential for each role it defines — access control and business logic are worked with those credentials in hand. |
| Mobile apps | Card, self-serve | One signed release build, exactly as you publish it: obfuscated, certificate pinned, and analysed without source. |
| APIs | Card, self-serve | One API, against an authorisation matrix written before anything is tested against it. |
| Thick client | Card, self-serve | The package you distribute, and the server that decides whether a check removed from the client mattered. |
| Secure code review | Card, self-serve | The codebase you point at — a file, a line, the path that reaches that line, and the change that closes it. |
| External network | Scoping call | The perimeter as it answers rather than as the asset list describes it, which is why the target count comes out of a scope proposal rather than into one. |
| Internal network | Scoping call | A deployed position inside the network, and a movement boundary written into the scope before the run rather than decided during it. |
| The one class where something is deployed inside your network. External and application testing needs nothing deployed at all. | ||
| Cloud | Scoping call | The identity and permission layer of a tenancy, with each permission proved by making the call rather than by reading the policy. |
| Active Directory | Scoping call | A directory and the privilege paths across it, walked rather than drawn, with the edges that held reported alongside the ones that did not. |
| Social engineering | Scoping call | A written authorisation naming the population and the window, agreed before anything is sent. |
| LLM applications | Scoping call | The application around the model: what it retrieves and trusts, what it renders, and which tools it can be made to invoke. |
The one class where something is deployed inside your network. External and application testing needs nothing deployed at all.
Where that one deployment is needed, it runs on-premise or inside your own cloud tenancy — deployment and residency sets out the four regions your data can sit in, and you choose which.
Every class links to its own page, and each of those states the defect classes it works, the standards it aligns to at their current versions, and what is fixed before a run begins. The coverage index holds all eleven together.
Scoping
Past one target, the number moves along three axes. Here is what each one is, what to have ready for it, and what it decides — so the call starts at the third question rather than the first.
Coverage is identical in all three delivery models, so axis three is a decision about assurance rather than about testing. The delivery models page sets out which one answers which need, and CERT-In empanelment is the instrument behind the two that carry a signature.
Where the cadence is the pipeline itself, the build gate describes the threshold you set and what happens at or above it, and the integrations index covers the four systems the step runs in.
The scoping call
There are two shapes of pentest pricing question: what does one application cost, and what does our estate cost. The first is answered further up this page. This is how the second gets answered.
| Step | What happens | In practice |
|---|---|---|
| 1 | You send the scope | The applications, APIs, ranges and tenancies you want covered, and what the output has to survive. We work out how many targets that is, because one scan is one application or one target. |
| 2 | We name the delivery model | If the report ends in a regulated filing, that decision is made for you: the auditor who signs it has to have been inside the engagement. |
| 3 | A written scope comes back | What a run would cover, and what it costs. The number is written against the estate you sent, so there is nothing left for you to work out at your end. |
| 4 | A call, only if it needs one | If the written scope answers the question, you already have the answer. If it raises one, we suggest times. |
1
2
3
4
One to three business days is the observed median from scope sign-off to report, and that figure belongs to the fully autonomous model. A median is not a service level, and nothing in a scope turns it into one.
If you would rather see a finished report before sending an estate, a walkthrough goes through a completed run screen by screen, and the $299 trial puts one against something you own.
What is on the page
The comparison set this site tracks is seven platforms. Six of them publish no price at all. The seventh ran a self-serve purchase flow and deprecated it on 16 July 2026.
What any of the seven charges is not stated here, because none of them states it. What is ours to state is the figure at the top of this page. It is on the page with no form in front of it, and you can hold any quote you receive against it.
Deliberately excluded
Card payment works without a sales conversation. Past a single target, send the scope and a written recommendation comes back with a price written against it.