A first assessment, or a single application ahead of a customer security review.
Also includes 3 platform users
Teams testing several applications a year and answering security questionnaires regularly.
Also includes 8 platform users · 5 self-service scans a month · 5 assets monitored
Continuous programmes across an estate, with several teams and their own administrators.
Also includes 20+ platform users · 20 self-service scans a month · 20 assets monitored
Every engagement is priced on scope and fixed before work starts. The platform is included with every engagement - there is no separate licence to buy. Scan allowances reset monthly, and seats and allowances can be agreed separately where a published plan does not fit.
Compare
Not sure which fits? Tell us your scope and we will tell you, including if the answer is the smallest one.
Pricing FAQ
Scope, almost entirely. The number of applications, the size of each one, how many distinct user roles need testing, whether an API and a mobile client are in scope, and whether internal network testing is included. We price on scope rather than on hours, so a tester finding something quickly does not cost you less and a difficult application does not cost you more.
No. The quote is the price. If we discover more attack surface partway through we tell you what we found and what it would take to cover it, and you decide whether to extend the scope for a future engagement. We do not issue change orders mid-engagement.
No. Vexil is included with every engagement. There is no separate licence, and the platform stays available to you afterwards so reports can be regenerated and retests requested.
Three on Single assessment, eight on Annual programme and twenty or more on Continuous testing. Seats can be agreed separately where a published plan does not fit what you need.
Yes, and it is a real retest: you mark a finding fixed, request a retest, and a tester verifies it by hand and records whether it passed or failed. It is not a rescan and it is not billed as new work.
Yes, as an annual programme rather than a single engagement. That suits teams shipping continuously, where a once-a-year test is out of date within a sprint. Talk to us about scope and cadence and we will price the programme.
That is what a single assessment is for: a single focused scope, fixed price, with the platform and a retest included. Many teams start there ahead of a customer security review and expand later.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform. If we are not the right fit we will say so. The questions we will ask are published, so there is nothing to prepare.