Already have a quote? Let's check it against published prices.
Quick Answer
Tell us your scope — not the other firm's quote — and we'll price it against our published rates within one business day. We do not ask you to send the other proposal itself; scope parameters belong to you, and that document usually carries a confidentiality clause. There are three possible answers: our price is lower, their price is fair for the scope, or you need a firm we're not (CREST-accredited, TLPT-capable, or MASA-authorised) — and we'll say which, plainly.
Why You Are Probably Comparing
If a SOC 2 or ISO 27001 auditor sent you here, there's a structural reason they gave you a shortlist instead of one name: a firm that both performs your penetration test and later audits its results loses independence. So auditors point to two or three testing firms and let you choose. Comparing prices and scope across a shortlist is normal, expected practice — not a sign you're being difficult, and not a sign you distrust either firm.
What We Need From You
Six scope parameters — what's being tested, how many roles, authentication method, API surface, size, and what prompted the engagement — plus, optionally, what you were quoted, so we can tell you how it compares.
We do not need, and do not ask for, the other firm's proposal document. There's no file upload on this page — that's deliberate, not an oversight.
What You Get Back
A price against our published grid, a short breakdown of what the scope you described justifies (and where it looks over- or under-scoped relative to what you described), an indicative delivery timeline, and what's included in the deliverable. No obligation, and no file needed from you to get it.
Three Possible Answers
1. Our price is lower
We'll show our number against our published grid and explain exactly what's included, so you can compare like for like.
2. Their price is fair
If your scope includes something we don't do at that price point — internal network, red team, mobile client — we'll say the quote looks reasonable for what it covers.
3. You need someone else
If your contract specifically names CREST, DORA TLPT, or MASA validation, we're not the right firm — we'll tell you that directly and take no fee for saying so.
If their quote is fair, we will tell you it is fair. That answer costs us nothing and saves you a week.
Our Published Prices
| Tier | Price (EUR, excl. VAT) | Delivery |
|---|---|---|
| Web App Vulnerability Assessment SEC-PENT-01 | €539 | 5 business days |
| Focused Web App Penetration Test SEC-PENT-02 | from €1,800 | 1.5–2 weeks |
| Standard Web App + API Penetration Test SEC-PENT-03 | from €4,500 | ~3 weeks |
| Enterprise SaaS Penetration Test SEC-PENT-04 | from €8,000 | 4–5 weeks |
| AI Red Team Pentest (add-on) OW-AIS-10 | + €990 | 10–14 business days |
Want an instant number instead of waiting a business day? Try the Pentest Cost Calculator.
How Scope Drives Price
What you're testing
A marketing site, a single logged-in app, an app with an API, a multi-tenant SaaS platform, or a mobile app + backend — each has a very different attack surface.
Roles behind the login
Each additional role (admin, standard user, guest, partner) is tested separately, and cross-role access is where most real findings come from.
Authentication complexity
Email/password is cheap to test. SSO/OAuth and especially SAML/MFA/custom flows have to be exercised end to end.
API surface
REST, GraphQL, and webhooks each add dedicated test time — including undocumented endpoints.
Application size
Distinct screens plus API endpoints. More surface area means more manual testing hours.
What prompted the engagement
A customer questionnaire, SOC 2/ISO 27001 audit, or NIS2/DORA/CRA readiness can require a fuller penetration test even where the raw scope looks small.