Pricing
One number, agreed before anything starts.
We quote after a scoping call rather than from a form. The ranges below tell you which band you are likely in, so you can have a budget conversation internally before you speak to us.
How we price
Fixed scope, fixed price, agreed before any work starts. We quote after a scoping call rather than from a form, because a number produced without seeing your architecture is a guess dressed up as a proposal. The figures below are indicative ranges for a typical engagement in each band. Your quote names one number and the work it covers.
Engagement tiers
Starter
From $9,500per engagement
Startups running their first serious assessment, usually ahead of a customer security review.
A focused test of one production application or one cloud environment, run end to end by a senior tester and reported in a form your engineers can act on the same week.
What is included
- External and web application testing for one product
- Cloud configuration review of one account or subscription
- Authenticated testing across up to two user roles
- Technical findings report with reproduction steps
- Executive summary for customers and leadership
- Prioritised remediation plan
- Walkthrough call with your engineers
- One retest of all findings within ninety days
Not included
- Internal network testing
- Social engineering and phishing simulation
- Ongoing advisory between engagements
Get a QuoteTimeline
Scoping in week one, testing across weeks two and three, report within five working days of testing ending.
Growth
Where most engagements startFrom $24,000per engagement
Mid-size organisations with several products, a real cloud footprint, and an audit or enterprise customer on the horizon.
Testing across your perimeter, applications and cloud, plus a risk assessment and a roadmap, so the findings turn into a plan instead of another backlog nobody owns.
What is included
- Everything in Starter, across up to three applications or environments
- Internal network and lateral movement testing
- API testing, including authorisation logic between roles
- Threat modelling workshop with your engineering team
- Risk register and control gap analysis against one framework
- Twelve-month security roadmap with effort bands
- Two retests within six months
- Quarterly check-in calls for a year
Not included
- Named response retainer with a contractual response time
- Recurring testing on a fixed cadence
Get a QuoteTimeline
Scoping in week one, testing across weeks two to five, workshop in week five, full documentation within ten working days.
Enterprise
Customquoted after scoping
Organisations with regulatory obligations, multiple environments, or a security programme that needs to be built and run rather than reviewed once.
A continuing relationship rather than a project. Recurring testing, architecture work, incident readiness, and named senior contacts who know your systems well enough to be useful in the first ten minutes of a call.
What is included
- Everything in Growth, with scope set by agreement rather than a cap
- Recurring testing on a cadence that fits your release cycle
- Security architecture and hardening support alongside your engineers
- Incident response retainer with a contractual response time
- Tabletop exercises twice a year
- Named lead consultant and a named backup
- Direct channel access to the team doing the work
- Evidence and questionnaire support during audits and enterprise reviews
Get a QuoteTimeline
Scoping over two weeks, programme begins within thirty days, delivery against a calendar we agree with you.
Every tier
What you get regardless of what you spend
These are not upsells and they are not conditional on the size of the engagement. They are the reason our clients come back.
- A senior practitioner on every engagement, never a junior learning on your estate
- Findings reported the hour we confirm them, not held back for the report
- No scanner output rebadged as analysis
- A retest of everything we report, included in the price
- Mutual NDA before scoping, and client paper signed where you have it
- An attestation letter for your customers and auditors
Pricing questions
Scoping, custom engagements and terms
Roughly a third of our work does not fit the three tiers above. That is normal, and it is quoted the same way.
Why is there no fixed price on every tier?
Because scope changes the number honestly. Two companies asking for a web application test can be four days apart in effort depending on the number of roles, the size of the API surface and how much of the estate is reachable. We give you a single fixed price after a scoping call, and we hold it unless you change the scope.
What counts as a custom engagement?
Anything that does not fit the shape above. A single high-risk application that needs six weeks rather than two. A merger where two estates have to be assessed at the same time. A regulated environment with on-site requirements or cleared staff. A retainer covering an agreed number of days per month. We scope these the same way and quote a single fixed number, and roughly a third of our work falls into this category.
How can you scope without seeing our systems?
We ask specific questions rather than generic ones: how many applications, how many user roles, how many cloud accounts, what the authentication model is, and what would hurt most if it leaked. Half an hour is usually enough. If it is not, we will say so and ask for read-only access to scope properly rather than pad the estimate.
Do you charge for the scoping call?
No. Scoping is free and it comes with no obligation. If the call makes it clear you do not need us yet, or that a different kind of work would help you more, we will tell you that instead of selling you a test.
What happens if you find something critical mid-engagement?
We stop and call you, using the escalation path we agreed during scoping. You get the finding, the evidence and enough detail to start fixing it that day. Helping you triage it costs nothing extra and does not consume engagement time.
Can we spread the payment across the engagement?
Yes. Standard terms are fifty percent at kick-off and fifty percent on delivery of the report. Retainers are billed monthly in advance. If your finance process needs something different, ask during scoping and we will usually accommodate it.
Do you discount for non-profits or early-stage companies?
We hold a small number of reduced-rate slots each quarter for non-profits and pre-seed companies. They are limited and they go quickly, but ask when you enquire and we will tell you honestly whether one is available.
Get a quote
Half an hour is usually enough to price it
Tell us how many applications, how many environments and what would hurt most if it leaked. We will come back with a fixed number and the work it covers.
