Pricing
Engagements start from £99 for a security assessment. Every penetration test after that is scoped individually - here's what typically drives the price, what's always included, and answers to the questions we get asked most.
What Affects Your Price
Web Applications & APIs
- Number of applications and API endpoints in scope
- User roles and authentication flows to test
- Depth of testing - OWASP Top 10 coverage or full business logic testing
- Whether source code review is included
Infrastructure & Cloud
- Number of external IPs, internal hosts or cloud accounts in scope
- External only, or internal network and Active Directory as well
- Cloud configuration and IAM review (AWS, Azure)
- Testing windows and rules of engagement for live systems
Assessment Type
- Vulnerability assessment - a broad, verified baseline across many systems
- Penetration test - deep manual testing and exploitation of specific targets
- Remediation support, if you want us to implement the fixes
- Compliance-driven requirements such as Cyber Essentials Plus or ISO 27001
Every engagement starts with a free scoping call and ends with a fixed quote or day-rate estimate in writing - no surprises. Retesting after remediation is included.
Frequently Asked Questions
General
Pricing depends on scope - mainly the number of applications, APIs, hosts or cloud accounts in scope and the depth of testing. Every engagement starts with a free scoping call and ends with a fixed quote, no surprises.
A free scoping call to understand what you need, followed by a fixed quote or day-rate estimate in writing - no work starts until you've agreed the scope and price.
Security Testing
No. We test carefully and avoid any actions that could cause downtime or data loss. For production systems, we agree on testing windows and rules of engagement before we start.
We notify you immediately - we don't wait for the final report. You'll know about critical issues as soon as we confirm them.
Yes. Unlike most security firms, we write code. We can implement fixes directly or work alongside your development team.
Yes. Our reports are structured to support compliance initiatives such as ISO 27001, Cyber Essentials Plus, SOC 2, and PCI DSS, with clear evidence of vulnerabilities, risk impact, and remediation steps.
Either. We recommend testing in an environment that mirrors production as closely as possible. If testing production, we take extra precautions.