Pricing
We do not publish a headline figure, because the same test can be two days against one login form or three weeks across a domain. What we do publish is exactly what moves the number, and how fast you get it.
What each engagement covers and roughly how long it runs. The figure follows the scope, and it is fixed in writing before anything starts.
5 to 10 working days
Manual testing of your web applications, APIs and internal networks against the same techniques a real attacker would use, with every finding evidenced and rated.
4 to 8 working days
A configuration and architecture review across cloud, identity and network, checking what is actually deployed against what your policies claim.
Retainer or ad hoc
Containment, forensics and recovery support when something has already happened, available ad hoc or on a pre-agreed retainer.
Monthly retainer
Ongoing security guidance for teams without a full-time security hire, covering architecture review, vendor assessment and policy work.
A quote is issued in writing after a short scoping conversation, and it does not move unless you change the scope and agree the change. Incident response is handled separately, because the scale is not known until we look.
Five things move a quote. We ask about all five before sending one, which is why the figure does not move afterwards.
One web application is not the same job as a public IP range or a Windows domain. The target decides the method.
The number of applications, hosts or endpoints in scope. Size drives days, and days drive the price.
Testing as an anonymous visitor is one pass. Testing as each user role, to find what one customer can reach of another customer, is several.
Most work happens in normal hours. A production system that can only be touched at night takes longer to arrange, not longer to do.
The retest is included. Support for your developers while they fix, or a readout for your board, is agreed up front if you want it.
Four things that are part of every engagement and never appear as a separate line on an invoice.
Every finding with reproduction steps, evidence and a fix. Written to be handed straight to a developer.
We verify your fixes and reissue the report once you have shipped them. No second engagement, no second invoice.
Agreed in writing before work starts. It does not move unless you change the scope and agree the change.
Written authorisation and rules of engagement, signed by both sides, before anything is touched.
Because a single figure would be misleading. The same engagement name covers two days against one login form and three weeks across a Windows domain. Publishing the low end wins a comparison we would then have to walk back, and that is a bad way to start. Tell us the target and you get a real number in two working days.
We tell you before we carry on, and nothing is billed that you have not agreed in writing. A quote that moves after you have signed it was never a fixed quote.
Yes. Once you have fixed the findings we test them again and reissue the report with the results. A test you cannot show you acted on is worth very little.
Yes. Scope a single application rather than everything at once, and the cost stays proportionate to the team paying for it.
Describe what needs testing and any deadline. We reply within two working days with a fixed quote, or with a question if the scope needs narrowing first.