⟶ PRICING & ENGAGEMENT MODELS
Offensive security, priced like infrastructure.Not consulting theater.
Transparent packages built around what we test and how deep we go. No hidden retests, no compliance markups, no "enterprise" pricing for SMBs. Start with a $2,000 diagnostic — scale to continuous coverage when it makes sense.
Start here. Low risk, real signal.
Our diagnostic assessment — designed for teams who want to see how we work before committing to a full engagement.
Three tiers. Across every product.
Every pentest product below ships in three tiers. Same methodology — different depth, cadence, and support.
| Capability | Essential | AdvancedPOPULAR | Continuous |
|---|---|---|---|
| OSINT & enumeration | ● | ● | ● |
| Manual + automated testing | ● | ● | ● |
| Privilege escalation & lateral movement | ● | ● | ● |
| Technical + executive report | ● | ● | ● |
| Methodology | Gray box | Black / Gray / White | Black / Gray / White |
| Business logic deep-dive | Standard | Extended | Extended |
| Threat modeling | — | ● | ● |
| Retests | 1× / 30 days | 2× / 90 days | Unlimited |
| Jira / Slack integration | — | ● | ● |
| Dev remediation support | — | ● | ● |
| Attestation letter (SOC 2 / ISO / PCI) | — | ● | ● |
| Kickoff SLA | 10 business days | 5 business days | 3 business days |
| Frequency | One-shot | One-shot | 2–4× / year |
Pick what to test. We price per asset, not per company size.
Six standardized products. Custom scopes available upon request.
P01 · Application Layer
Web Application
One web application. Up to 2 user roles and 1 environment. Authentication, session, business logic, and OWASP Top 10 coverage.
Essential
7 business days
Advanced
12 business days
Continuous
4 tests / year
ADD-ONS
+ Extra role: $1,200 · Extra env: $1,500
P02 · Application Layer
API
REST, GraphQL, or SOAP. Authentication, authorization, rate limiting, schema introspection, and business logic abuse.
Essential
6 business days
Advanced
10 business days
Continuous
4 tests / year
ADD-ONS
+ Up to 50 endpoints. Each +25: $1,000
P03 · Application Layer
Mobile App
iOS or Android. Static analysis, dynamic instrumentation, and backend coverage. Reverse engineering and runtime manipulation.
Essential
8 business days
Advanced
13 business days
Continuous
4 tests / year
ADD-ONS
+ Second platform (iOS + Android): +60%
P04 · Infrastructure
External Network
Internet-facing IP ranges, perimeter services, VPN gateways, exposed admin panels. The attacker's view from the outside.
Essential
6 business days
Advanced
10 business days
Continuous
4 tests / year
ADD-ONS
+ Up to 50 IPs. Each +50: $1,200
P05 · Infrastructure
Internal Network
Active Directory, lateral movement, segmentation testing, domain escalation. Simulates an established foothold inside your perimeter.
Essential
10 business days
Advanced
15 business days
Continuous
2 tests / year
ADD-ONS
+ Up to 250 IPs · Assumed breach: $3,000
P06 · Cloud
Cloud Security Review
AWS, Azure, or GCP. IAM policies, storage exposure, network segmentation, identity boundaries, and secret hygiene.
Essential
8 business days
Advanced
13 business days
Continuous
2 reviews + monitoring
ADD-ONS
+ Extra account: +30% · Multi-cloud: +50%
PTaaS. Always-on offensive coverage.
Annual subscription combining multiple products with unlimited retests and async support. Built for SaaS teams shipping weekly.
Starter
For teams running 1–2 critical assets
- +2 products of choice (e.g. web + API)
- +2 tests per product, per year
- +Unlimited retests
- +Portal access with real-time findings
- +Async chat support (Mon–Fri)
- +Jira / Slack / Linear integration
- +3-business-day kickoff SLA
Growth
For SaaS in active expansion
- +3 products of choice
- +4 tests per year
- +Unlimited retests
- +Attestation letters (SOC 2 / ISO 27001)
- +Quarterly Business Review
- +Dedicated lead operator
- +Async + scheduled call support
- +3-business-day kickoff SLA
Enterprise
Custom scope, custom scale
- +Up to 5 products in scope
- +Unlimited tests and retests
- +Compliance-grade reporting (PCI, FedRAMP)
- +Dedicated team of 2–3 operators
- +Custom SLAs and on-call coverage
- +Threat intelligence briefings
- +Multi-environment / multi-region
- +Same-week kickoff
Special engagements. Quoted case-by-case.
Engagements that require custom scoping. The ranges below are starting points — final pricing after a 30-minute scoping call.
Red Team Engagement
Objective-based · multi-vector
Adversary Simulation
TTP emulation · purple team · MITRE ATT&CK aligned
Social Engineering & Phishing
Targeted campaigns · vishing · pretexting
Source Code Review
Manual + SAST · architecture-aware
IoT / Hardware Pentest
Firmware · radio · embedded · supply chain
AI / LLM Security
Prompt injection · model abuse · data leakage
// Fine print worth reading
- 01Every package includes at least one retest. Advanced and Continuous tiers include additional retests as listed in the comparison table.
- 02Prices reflect standard scopes. Complex environments may require adjustment after a free scoping call — no hidden fees once the SOW is signed.
- 03Compliance-driven engagements (PCI-DSS, HIPAA, FedRAMP, SOC 2) carry a 15–30% premium to cover evidence collection and audit-ready documentation.
- 04Retainer model available: purchase a bucket of hours and consume across 12 months at a blended rate. Best suited for unpredictable scopes.
- 05USD pricing is the contractual standard for cross-border engagements. International payments accepted via wire transfer or Stripe.
- 06All engagements operate under a signed MSA + NDA + Statement of Work + Rules of Engagement. Nothing starts without paperwork.
Ready to know what you actually look like to an attacker?
Book a 30-minute scoping call. No sales theater. We'll tell you which package fits — or that you don't need us yet.