Transparent pricing

Pentest pricing, made transparent.

We do not sell off-the-shelf packages. Every engagement is scoped against your assets, company profile, and compliance posture. Below is exactly how we price.

Try our free one-day audit
Express tier

Quick Audit · AI-Assisted

$1,000 – $3,000
Final price depends on scope — agreed before any work starts.

A fast, focused security check of your application — driven by a senior pentester who uses our internal AI tooling heavily to multiply coverage. Designed for startups and product teams who want a real assessment, fast, without enterprise pricing.

AI alone is not enough. Off-the-shelf AI pentest tools produce a flood of false positives — and miss the bugs that matter. Our pentester drives the AI: framing prompts, filtering noise, validating every finding by hand.
A real human does the pentest. AI accelerates discovery. The actual exploitation, business logic review, and validation are done by an OSCP/OSWE-grade engineer — not handed off to a model.

Tell us your scope and we will reach out within one business day to confirm the engagement.

2–3 business days · what each day covers
  1. 1
    AI-driven discovery + pentester triage

    Our AI tooling fans out across the scope under the pentester's direction — surface enumeration, parameter mapping, candidate vulnerability identification. The pentester reviews each AI-flagged item and filters out the noise.

  2. 2
    Manual validation + finding verification

    The human-only step. The pentester hands-on verifies each promising candidate, attempts real exploitation, eliminates false positives, and chains anything that combines. No finding makes it to the report without a working reproduction.

  3. 3
    Security report + retest of fixes

    A clear report with executive summary, technical reproduction steps for each finding, severity, and remediation guidance. If you ship fixes within 14 days, we re-verify them at no extra cost.

How we price

Six factors shape every engagement.

Pricing in this industry is rarely as simple as "days × testers." Day rates assume a constant complexity — and security assessments are anything but. Here is what actually moves the number.

Scope size

How much there is to test — number of applications, APIs, hosts, user roles, and authenticated paths. The single biggest cost lever.

Company size & posture

A mid-stage startup and a Fortune 500 do not face the same threat model. Enterprises with regulated data or critical infrastructure pay accordingly.

Testing depth

Black-box (no information) is more expensive than grey-box. White-box assessments with source review and architecture analysis are the deepest tier.

Compliance overlay

SOC 2, PCI DSS, HIPAA, ISO 27001, FedRAMP, and NIS2-aligned engagements require additional documentation and certified assessors. Adds 15–30% on average.

Tester expertise

Our team holds OSCP, OSWE, OSWP, GXPN, GWAPT, eCPPT, eMAPT, and eWPTX. Senior researchers are billed at a premium and you can request specific seniority.

Timeline & retest

Standard engagements run 1–3 weeks. Rush delivery, extended timelines, and ongoing retest contracts are priced separately.

Scope dimensions

What we test, and what drives complexity

We do not publish a fixed price per asset because no two engagements are alike. Below is what is involved at each level of your stack and what tends to push complexity up.

Web Application

5–15 business days
What we test
AuthenticationAuthorizationSession handlingInput validationBusiness logicThird-party integrations
What pushes your engagement higher
  • +Number of user roles
  • +Multi-tenant data isolation
  • +Payment & sensitive flows
  • +SSO / federated identity

API (REST / GraphQL)

5–12 business days
What we test
BOLA / IDORFunction-level authRate limitingMass assignmentGraphQL depth & field-auth
What pushes your engagement higher
  • +Endpoint count
  • +Public vs partner-facing
  • +Multi-tenant isolation
  • +Federated identity

Mobile App (per platform)

7–14 business days
What we test
Local storageTransport securityDeep linksIPCThird-party SDKsAnti-tamperCert pinning
What pushes your engagement higher
  • +Native code volume
  • +Biometric & in-app crypto
  • +Jailbreak / root detection
  • +Offline / sync features

Network (Internal / External)

7–21 business days
What we test
Host enumerationService hardeningAD / identity boundariesLateral movementOptional wireless
What pushes your engagement higher
  • +Number of hosts in scope
  • +Network segmentation depth
  • +Active Directory complexity
  • +OT / IoT coverage

Cloud Infrastructure

7–14 business days
What we test
IAM designNetwork controlsWorkload hardeningSecrets managementThird-party SaaS
What pushes your engagement higher
  • +Multi-account / multi-region
  • +Number of services in use
  • +Federated identity model
  • +Regulated data classification

Source Code Review

10–20 business days
What we test
Auth & crypto patternsData flowDependency riskBusiness logicSecure-by-default patterns
What pushes your engagement higher
  • +Lines of code
  • +Number of services / repos
  • +Language diversity
  • +Architectural depth requested

Red Team Engagement

4–8 weeks
What we test
Application surfaceInfrastructureSocial engineeringPhysical (where in scope)
What pushes your engagement higher
  • +Defined objectives & rules of engagement
  • +Breadth of attack surface
  • +Detection-maturity targets
  • +Assumed-breach vs full-stealth start
How to read this: the more items on the complexity drivers list that apply to you, the further toward the upper end of your company profile range your engagement is likely to fall. Combined-scope engagements (web + API + cloud) are scoped as a single program — not as the sum of standalone tests.
By company profile

What organizations like yours typically spend

The threat model of a 30-person startup is not the threat model of a regulated multinational. Enterprises with critical-infrastructure exposure, regulated data, or public-market scrutiny carry materially different risk profiles.

Startup / Early-stage

< 50 employees · pre-Series B · single product

One web app or API. Often pursuing first SOC 2 or enterprise contract.

Typical engagement
$6,000 – $15,000
Annual program
$8K – $20K / year

Small / Mid-Sized Business

50 – 250 employees · multi-product · recurring customers

Web app + API + a small cloud footprint. Annual or pre-launch cadence.

Typical engagement
$15,000 – $40,000
Annual program
$20K – $50K / year

Mid-Market

250 – 2,000 employees · multiple business units · regulated industry

Multi-app web/API/mobile coverage, with cloud and internal network components.

Typical engagement
$40,000 – $90,000
Annual program
$60K – $150K / year

Enterprise / Regulated

2,000+ employees · public, financial, healthcare, energy, or telecom

Comprehensive program: multiple apps + cloud + network + red team option. Continuous engagement model is common.

Typical engagement
$90,000 – $250,000+
Annual program
$150K – $500K+ / year

A note on enterprise pricing

Engagements with public companies, critical infrastructure operators, financial institutions, and large healthcare providers are priced not only against scope but against operational risk, indemnity requirements, and the standards their auditors and regulators expect. We routinely scope engagements in the $80K–$250K range for organizations with multi-billion-dollar revenue and broad attack surface. Custom quotes for organizations of this profile are always required.

Compliance overlay

When you need audit-aligned reporting

Compliance-driven engagements require certified assessors, additional documentation, and reporting formats your auditors will accept. The uplifts below are applied to the underlying asset pricing.

FrameworkUpliftWhat it adds
SOC 2 Type I / II+10–20%Mapped findings, attestation-ready evidence, auditor-friendly artefacts.
PCI DSS+15–25%Certified assessor coverage, segmentation testing, ASV alignment.
HIPAA / HITRUST+15–25%PHI handling review, technical safeguards mapping, risk analysis.
ISO 27001 / 27017+10–20%Annex A control mapping, ISMS evidence pack.
FedRAMP+25–40%NIST 800-53 control coverage, FedRAMP-ready reporting format.
NIS2 / DORA+15–25%EU-aligned reporting, critical entity scoping, ICT risk mapping.
Every engagement

What is always included

Regardless of price tier, every BugSwagger engagement delivers the same baseline of evidence, documentation, and post-engagement support. We do not charge separately for the report, the retest, or the handoff call.

See our full methodology
  • Executive summary written for non-technical leadership
  • Full technical report with reproduction steps and CVSS scoring
  • Findings prioritized by impact and exploitability
  • Architecture and remediation recommendations
  • Knowledge-transfer call with your engineering team
  • 30–60 day retest of remediated findings (included)
  • Letter of attestation suitable for procurement and audit
  • Direct access to the tester(s) for follow-up questions
Start an engagement

Get a tailored proposal in one business day.

Tell us what you are protecting, who you serve, and any compliance context. We will respond with a scoped engagement, transparent pricing, and a proposed timeline — no sales pitch.

Try a free audit