PRICING
The price, before the call.
Tiers are named for the number of external assets they cover. Pick the one your estate fits and you have the price, with no discovery call in between.
THE SHORT ANSWER
An assessment starts at $900 for up to 5 assets. Continuous monitoring starts at $300 a month at the same ceiling. The number in the tier name is the ceiling, and one asset is one repository or one hostname.
What counts as an asset
One asset is one repository, or one hostname or IP serving a distinct application or API. Repositories and hostnames count equally.
COUNTS
- Each repository in scope
- Each hostname serving a distinct application or API, such as app.acme.com and api.acme.com
- Each public IP running a service that is not already behind a counted hostname
DOES NOT COUNT
- Pages and routes inside a single application; an app with 200 screens is one asset
- Subdomains that only redirect to a host already counted
- A staging or preview environment mirroring a counted production host, since it is the same application tested once
- Forks and mirrors of a repository already counted
Count yours, pick the tier it fits, and that is the price. If you are near a boundary, say so and we will tell you which side you land on before anything is signed.
Assessments
A penetration test by a named engineer, delivered as a report an auditor can use. One-time.
CPT-A5
Assessment 5
$900
one time · up to 5 external assets
A white box penetration test of up to 5 assets, delivered as a report that states scope, method, findings and closure.
- Up to 5 assets, repositories and hostnames together
- Source and credential access, so budget goes to testing rather than discovery
- Findings validated before they reach the report
- One retest with a dated verification record
- A redacted one-page summary for customers and auditors
CPT-A15
Assessment 15
$1,400
one time · up to 15 external assets
A white box penetration test of up to 15 assets. The tier most products land in: an app, an API, the infrastructure that runs them, and the hostnames in front.
- Up to 15 assets, repositories and hostnames together
- Everything in Assessment 5
- Cross-tenant and role-boundary testing across the wider surface
CPT-A30
Assessment 30
$2,100
one time · up to 30 external assets
A white box penetration test of up to 30 assets, for a multi-service product or an audit whose scope statement covers more than one system.
- Up to 30 assets, repositories and hostnames together
- Everything in Assessment 15
- Scope split across multiple repositories and environments
Delivery
Standard
Report in 3 to 5 business days
Included
Priority
Testing starts within 24 hours
+$250
If the real scope exceeds the ceiling you move up a tier, and we say so before testing starts, not on the invoice.
Past 30 assets the work stops being a fixed-price assessment, so there is no published tier for it. Tell us the shape of the estate and we will price it properly rather than pretend it fits.
Continuous monitoring
Scanning across the same assets, covering the months between assessments. Billed monthly, cancel whenever.
CPT-M5
Monitoring 5
$300/month
up to 5 external assets
Continuous scanning of up to 5 assets, covering the months between assessments.
- Up to 5 assets, repositories and hostnames together
- Continuous scanning, triaged rather than dumped on you
- Alerts on a newly exposed asset or a newly disclosed vulnerability that reaches you
- A dated monthly record, which is what a Type II observation window wants
CPT-M15
Monitoring 15
$500/month
up to 15 external assets
Continuous scanning of up to 15 assets.
- Up to 15 assets, repositories and hostnames together
- Everything in Monitoring 5
CPT-M30
Monitoring 30
$1,000/month
up to 30 external assets
Continuous scanning of up to 30 assets.
- Up to 30 assets, repositories and hostnames together
- Everything in Monitoring 15
Monitoring is not a substitute for an assessment, and we would rather say so than sell you one instead of the other. A scan checks known software for known vulnerabilities; it cannot evaluate whether one of your customers can reach another customer's data. See penetration test vs vulnerability scan.
What we do not do
- Threat-led or red team engagements, which are a different exercise
- FedRAMP assessments, which must be performed by an accredited 3PAO
- Physical or social engineering testing unless separately scoped
- Remediation work itself, since testing your own fixes is not independent
Listed because a vendor who claims to do everything is describing a sales process rather than a practice. See FedRAMP for why some assessments require an accredited assessor.
Questions people ask
How much does a penetration test cost?
An assessment starts at $900 for up to 5 assets and reaches $2,350 at 30 assets with priority delivery. The tier name is the asset ceiling, so you can price yourself without a call.
What counts as an asset?
One asset is one repository, or one hostname or IP serving a distinct application or API. Repositories and hostnames count equally. Pages and routes inside a single application are not separate assets, and a staging environment mirroring a counted production host is not counted twice.
What happens if the scope turns out to be larger?
If the real scope exceeds the ceiling you move up a tier, and we say so before testing starts, not on the invoice. Past 30 assets the work stops being a fixed-price assessment, so there is no published tier for it. Tell us the shape of the estate and we will price it properly rather than pretend it fits.
What is the difference between an assessment and monitoring?
An assessment is a penetration test: a person testing the logic specific to your system, producing the dated artifact an auditor puts in a workpaper. Monitoring is continuous scanning of known vulnerabilities across the same assets, covering the months between assessments. Most frameworks expect both, and PCI DSS names them as separate requirements.
Is the retest included?
Yes, one retest of remediated findings with a dated verification record. That record is usually worth more to an audit than the original report, because it shows the vulnerability management control closing a loop rather than only finding a problem.
Why publish prices when most firms do not?
Because the inputs that change the cost are knowable in advance and a discovery call does not make them more accurate. Publishing lets a budget holder plan before engaging, and lets you compare vendors like for like.