Pricing

Simple, scoped pricing

Every engagement is scoped to you. These starting points give a sense of investment — your final quote is fixed and transparent.

Starter Assessment

$399

A focused web application security assessment — automated and manual testing with clear, actionable reports.

  • Web application testing
  • Automated + manual testing
  • Executive & technical reports
  • One-time engagement
Request Quote
Most popular

Professional

$1,500

Comprehensive testing across your external surface and key internal systems.

  • Up to 5 assets
  • Full manual penetration testing
  • Network + API testing
  • Remediation workshop
  • 90-day retest
Request Quote

Enterprise / Red Team

Custom

Goal-based red teaming and continuous security partnership, scoped to you.

  • Unlimited scope
  • Red team operations
  • Dedicated security partner
  • 24/7 incident retainer
  • Quarterly reviews
Talk to Sales

Managed Security (MSP)

$120 /monthly

24/7 managed SOC, monitoring, and support — priced per user, or a flat company rate.

  • $120 per user / month
  • Or a flat $700 / company / month
  • 24/7 SOC monitoring & support
  • Managed SIEM + MDR
  • Incident response included
  • Monthly reporting
Get MSP pricing

All prices in USD. Academy courses are priced separately — many are free.

How it is priced

What moves the number

Security work is priced by effort, and effort is driven by scope. Two assessments with the same label can differ several times over in cost, so we scope before we quote rather than after.

Size of the target

The number of applications, APIs, hosts, cloud accounts or sites in scope. A single web app and a group of twenty internal services are not the same engagement.

Depth of testing

An authenticated test across several user roles takes longer than an unauthenticated surface review, and a goal-based red team longer again.

Access and environment

Whether credentials, source code or a staging environment are available. Good access usually makes an engagement cheaper, not dearer, because less time goes on guesswork.

Reporting and retest

Whether you need a technical report only, or also an executive summary, evidence pack for an auditor, and a retest once fixes are in.

Included as standard

What every engagement comes with

  • A written scope before work starts. Targets, methods, timing and rules of engagement agreed in writing, so there is no argument later about what was in or out.
  • Manual testing by a named operator. Automated tooling is a starting point, not the deliverable.
  • A report you can act on. Findings with evidence, severity ratings and specific remediation guidance — written to be handed to the engineer who has to fix it.
  • A debrief. A walkthrough of the findings with your team, with questions answered.
  • A retest once fixes are in. A finding is not closed because it was reported; it is closed because it was verified fixed.
Common questions

Before you ask for a quote

Is the quote fixed, or does it move?

Fixed. Once the scope is agreed the price is agreed with it. If something material turns up that changes the scope, we stop and discuss it rather than quietly billing more.

Do you charge for the scoping call?

No. Working out what you actually need — and saying so if that is less than you asked for — is part of quoting.

Can you work to a fixed budget?

Usually. Tell us the budget and we will tell you honestly what can be covered properly within it, and what would be better left for a later phase. We would rather do less well than everything badly.

What do you need from us to quote?

A rough inventory of what is in scope, whether testing is authenticated, and any timing constraints. If you are not sure, the scoping call exists to work that out.

How do Academy courses relate to this?

They are priced separately and many are free. Training individuals and securing an organisation are different purchases.

Ask for a scoped quote