Still comparing the market? What a penetration test costs
A first assessment, or a single application ahead of a customer security review.
Also includes 3 platform users
Teams testing several applications a year and answering security questionnaires regularly.
Also includes 8 platform users · 5 self-service scans a month · 5 assets monitored
Continuous programmes across an estate, with several teams and their own administrators.
Also includes 20+ platform users · 20 self-service scans a month · 20 assets monitored
Every engagement is priced on scope and fixed before work starts. The platform is included with every engagement - there is no separate licence to buy. Scan allowances reset monthly, and seats and allowances can be agreed separately where a published plan does not fit.
Starting prices
Quoted on your scope, but here is where each engagement starts - a floor, not a cap. A manual web application test, by an OSCP-certified person with a manually verified retest, starts around what many vendors charge for an automated scan.
Larger scopes land higher, and red teaming, AI red teaming and consulting are quoted on scope. Tell us your scope for a fixed number.
Start small
You do not have to start with a continuous testing programme. If you need one application assessed for a customer review, begin with that requirement and confirm the scope with the person requesting the evidence.
Tell us what needs testing, your deadline and any budget constraint. We will explain the coverage, exclusions and fixed price so you can decide whether the engagement fits.
Prepare test accounts, user roles and available documentation before the scoping call. Clear information helps us quote the actual work. If coverage needs to be phased, the exclusions stay visible and must be acceptable for your review.
New to buying a test? Our guide for small and midsize businesses walks through scope, quotes and evidence.
Compare
Not sure which fits? Tell us your scope and we will tell you, including if the answer is the smallest one.
Pricing FAQ
Scope, almost entirely. The number of applications, the size of each one, how many distinct user roles need testing, whether an API and a mobile client are in scope, and whether internal network testing is included. We price on scope rather than on hours, so a tester finding something quickly does not cost you less and a difficult application does not cost you more.
No. The quote is the price. If we discover more attack surface partway through we tell you what we found and what it would take to cover it, and you decide whether to extend the scope for a future engagement. We do not issue change orders mid-engagement.
No. Vexil is included with every engagement. There is no separate licence, and the platform stays available to you afterwards so reports can be regenerated and retests requested.
Three on Single assessment, eight on Annual programme and twenty or more on Continuous testing. Seats can be agreed separately where a published plan does not fit what you need.
Yes, and it is a real retest: you mark a finding fixed, request a retest, and a tester verifies it manually and records whether it passed or failed. It is not a rescan and it is not billed as new work.
Yes, as an annual programme rather than a single engagement. That suits teams shipping continuously, where a once-a-year test is out of date within a sprint. Talk to us about scope and cadence and we will price the programme.
That is what a single assessment is for: a single focused scope, fixed price, with the platform and a retest included. Many teams start there ahead of a customer security review and expand later.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform. If we are not the right fit we will say so. The questions we will ask are published, so there is nothing to prepare.