Pentests are quoted per scope.
Scanning has public prices.
A simple app and a banking system are not tested at the same price: for manual penetration testing we prepare a quote for your scope, risk profile and timeline. The automated scanning platform has public plans, below.
Scan yourself, pay only for what you open
Check your organization’s security posture for free. You only pay when you open a detailed report or add advanced scans — or choose a subscription.
- Posture scans: Quick, Standard, Deep
- See your overall security level
- €175 — to open a detailed report
- +€25 — each specialized scan
- 3 detailed reports / month
- All scan options included
- Complex, recurring and compliance scans
- No per-report cost (up to 3/month)
- Unlimited reports
- All scan options
- Recurring and compliance scans
- Priority support
Penetration testing isn’t a standard product
A price shown without context creates the wrong expectations: either you overpay for a narrow scope, or you underpay for a complex environment.
Scope differs significantly
An internal app, an organization of hundreds of users and a hybrid data center can’t require the same effort — in time or in risk exposure.
Depth is set contractually
Black-box, gray-box or white-box; with or without exploitation proof; with or without re-testing — each option changes the team’s effort.
Compliance needs documentation
NIS2, GDPR or auditor requirements demand additional documentation, not just a standard technical report.
What shapes the final quote
During the initial consultation we define these parameters together — you get a reasoned estimate, not a value pulled from a generic table.
Attack surface
Number of apps, IP addresses, domains, environments (production, staging) and external integrations.
Type of testing
Network, web apps and API, mobile, cloud, social engineering — individually or combined.
Access & information
Access accounts, documentation, VPN, on-site presence — richer context enables more efficient testing.
Rules of engagement
Testing windows, DoS restrictions, critical systems — they define the way of working and project duration.
Deliverables & retest
Leadership report, presentation, post-remediation verification included or separate, follow-up assistance.
Urgency & timeline
Standard turnaround (2–4 weeks) versus an accelerated project with dedicated resources.
From request to tailored quote
Before the contract you receive a written quote with the services included, person-days, timeline and final price.
Analysis meeting
30–45 min. We clarify goals: audit, incident, contractual requirements, NIS2 compliance. No obligation.
Scope definition
Scope, exclusions, rules of engagement, deliverables — all documented in writing.
Commercial proposal
Estimate in person-days, execution timeline, total value. Usually a reply within one business day.
Contract and payment
Contract, NDA, invoice (MDL, EUR or RON). For large projects, staged payments.
What we can assess for your organization
Every project receives a tailored quote after the scope is defined.
Infrastructure & Network
Network scanning, firewall & ACL, wireless & VPN. Black-box, gray-box or comprehensive.
Web Security
Full OWASP Top 10, SQLi, XSS, CSRF, IDOR, REST / GraphQL API audit. Free re-testing.
Mobile Security
Static (APK/IPA) + dynamic analysis, OWASP Mobile Top 10, API & local storage.
Cloud Security
IAM, policies, permissions review, exposed public resources, CIS Benchmarks compliance.
Social Engineering
Phishing, vishing, pretexting, physical access & impersonation, awareness training included.
Phishing Campaigns
Custom landing pages, tracking, detailed report with statistics, post-campaign recommendations.
Included in every standard project
Regardless of the quote value, the structure of the delivered documentation stays clear and predictable.
- Technical report with CVSS severity and reproduction steps
- Executive summary for leadership
- Findings prioritized by business impact
- Concrete, actionable remediation recommendations
- Assistance for clarifications during the project
- Post-remediation verification for critical vulnerabilities
About quotes and budget
After the scoping discussion we can indicate an indicative range based on complexity. Without a defined scope, any figure would be misleading.
Yes. For a fair comparison, make sure the scope, deliverables and retest are identical across quotes.
Yes. Tell us the cap — we propose a realistic scope that maximizes risk coverage within the budget.
B2B contract, NDA, invoice by bank transfer in MDL, EUR or RON. For large projects, staged payments at contractual milestones.
Request a quote tailored to your context
Send a short description of the scope or write to us with your questions — we’ll come back with a clear proposal, with no surprise costs.