Simple pricing for a real pentest.

Human-reviewed findings in hours and the depth of a code review. Choose a single test, a pack of runs, or a custom plan for your team.

Recon$490 / jobA pentest of one staging or preproduction address, your web app or your API.+ 1 staging or preproduction address+ Pentest of that address, no source code+ Human-reviewed dossier and fixes+ One retest of the pentestBuy Recon

PentestMost requested$1,490 / jobA pentest of up to four staging or preproduction addresses. Connect your code for a deeper review.+ Up to 4 staging or preproduction addresses+ Pentest of each one+ Code review of up to 2 GitHub repositories+ Human-reviewed findings and fixes+ One retest of the pentest. The code review is not retestedBuy Pentest

ContinuousCustomRegular pentests of your staging or preproduction releases, with code review included. Choose this for custom runs, custom zones, or any other custom scope.+ Scheduled and on-deploy runs+ Custom runs, custom zones, and other custom scope+ As many staging or preproduction addresses as you need+ Source included on each run, up to 2 repositories+ Direct contact with our security teamBook a meeting

+Human sign-off on every finding
+Proof of exploitability
+Step-by-step fixes
+One retest included
+Staging only, never production

A target is a single staging or preproduction URL. app.staging.company.com and api.staging.company.com count as two. Not sure what you need? Book a meeting.

Pricing questions

01What counts as a target?

A target is a single staging or preproduction URL. app.staging.company.com and api.staging.company.com count as two targets. Recon covers one, Pentest covers up to four. We do not test production.

02When does the pentest start?

Nothing starts when you buy. The package sits in your account until you confirm the staging or preproduction domain and share the details, so you can buy now and run it when your release is ready.

03How do packs of runs work?

Buy 6 runs for 30% off or 12 runs for 45% off. That is enough to test once a month for six or twelve months.

04Is a retest included?

Yes. Recon and Pentest each include one retest of the pentest, so you can confirm your fixes work. The code review is not retested.

Start with one pentest.

Buy a package, confirm your staging address when you are ready, and get findings back in a few hours. A human signs the final report.

Get Started Book a meeting

Reviewed by a human, every time