Pricing and engagement models
Key takeaways
- Fixed scope, fixed price. We do not bill by the hour for assessment work.
- A retest after remediation is included on every assessment engagement.
- Retainers include priority response and scheduled testing rather than only a hotline.
- Emergency incident work is priced per incident, starting at ₹35,000.
Price bands by service
These are indicative bands for a typical scope. The final figure depends on the number of assets, depth of authentication, number of environments and the deadline. We confirm a fixed price in writing before any work begins, and it does not move unless the scope changes — in which case we tell you first.
| Service | Indicative band | Typical turnaround |
|---|---|---|
| VAPT & penetration testing | ₹45,000 – ₹3,50,000 | 5–10 working days |
| Web application security testing | ₹45,000 – ₹2,50,000 | 5–10 working days |
| Mobile app security testing | ₹60,000 – ₹2,50,000 | 7–12 working days |
| API security testing | ₹50,000 – ₹2,00,000 | 5–10 working days |
| Network penetration testing | ₹75,000 – ₹3,00,000 | 7–15 working days |
| Cloud security assessment | ₹80,000 – ₹3,50,000 | 7–12 working days |
| Cyber security audit & gap assessment | ₹60,000 – ₹4,00,000 | 10–20 working days |
| Incident response (per incident) | From ₹35,000 | Under 4 hours for retainer clients |
| Ransomware recovery | ₹40,000 – ₹5,00,000 | Emergency, within 4 hours |
| Website malware removal | ₹15,000 – ₹75,000 | 24–72 hours |
| Deepfake protection retainer | ₹25,000 – ₹4,00,000 | Monitoring within 48 hours |
| Digital forensics | ₹30,000 – ₹2,50,000 | 7–20 working days |
| Account & data recovery | ₹5,000 – ₹50,000 | 24 hours to 7 days |
| Social media account security | ₹8,000 – ₹60,000 | 24–72 hours |
| Email security & BEC defence | ₹35,000 – ₹1,50,000 | 5–10 working days |
| Phishing simulation | ₹15,000 – ₹1,20,000 | Campaign live in 5 days |
| Awareness training (annual) | ₹18,000 – ₹2,00,000 | Live in 10 days |
| Bug bounty programme setup | ₹75,000 – ₹3,00,000 | 4–8 weeks to launch |
| Red team assessment | ₹1,50,000 – ₹8,00,000 | 3–6 weeks |
| Managed SOC (monthly) | ₹35,000 – ₹2,50,000 | Live in 10 days |
| VDP setup | ₹35,000 – ₹1,20,000 | 3–5 weeks |
| IoT & firmware testing | ₹80,000 – ₹4,00,000 | 2–4 weeks |
| DPDP Act & CERT-In readiness | ₹50,000 – ₹3,00,000 | 10–20 working days |
| Third-party risk assessment | ₹70,000 – ₹3,00,000 | 10–20 working days |
Engagement models
| Model | How it works | When it suits |
|---|---|---|
| Fixed scope | A defined test against a defined estate, delivered to a date, at a fixed price. | A first assessment, a certification requirement, or a specific deadline. |
| Retainer | A monthly engagement with scheduled testing, priority response and quarterly reviews. | An ongoing security function you do not want to hire for. |
| Incident response | Priced per incident, engaged on demand, with a response SLA. | When something is already happening. |
| Managed service | A monthly fee for monitoring, triage and vulnerability management. | When you need a 24/7 watch but not a 24/7 team. |
| Embedded support | We work inside your team on a retainer, in your repositories and your tooling. | Product teams that want security in the design phase. |
What is always included
- The scoping conversation, before the quote, so the price fits your estate.
- A written rules-of-engagement document signed by both sides.
- A live finding log during the engagement.
- A technical report with reproduction steps and a one-page executive summary.
- A retest after remediation, with each finding marked closed, partial or open.
What is charged separately
Nothing is charged unexpectedly. Travel and accommodation for on-site work are billed at cost. Cloud infrastructure, tooling licences and third-party services (such as SIM farms or premium threat feeds) are billed at cost, and only where the engagement genuinely requires them. Retesting is included, not billed.
Get a fixed quote
Send the scope and the deadline. You will get a price band and a start date, with the reasoning shown.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.