A price linked
to the findings.
The commercial model is straightforward: pay for confirmed vulnerabilities according to their severity.
A different way to pay for security
Every finding.
A clear price.
You pay a fixed price for each confirmed vulnerability, set by its severity, and never more than the cap agreed for your scope.
Let’s define your scopeNo findings. No fee.
If we find no vulnerabilities,
you pay nothing for the audit.
Severity assessed using CVSS. Informational findings and hardening advice are free. Evidence for every finding.
Price caps by scope
The cap depends on what we test, not on the size of your company. We agree on the scope and the cap in writing before testing starts.
All amounts are in US dollars (USD). Prices and audit fee caps exclude applicable taxes. Any tax due will be shown separately on your invoice.
Your agreed cap is the maximum audit fee before applicable taxes. If the findings add up to more, every additional confirmed vulnerability is still included in your report at no extra charge.
- One web application or API (up to ~50 endpoints, 2 user roles)
- Up to $1,500
- Up to 3 applications or APIs, or up to ~200 endpoints
- Up to $4,000
- Larger scope
- Individual cap, from $8,000
Example: a test of one API finds 1 High, 3 Medium and 5 Low vulnerabilities. The invoice is $400 + $450 + $250 = $1,100, below the $1,500 cap. If the same test finds nothing, you pay nothing.
Agree before we begin
We define the scope, the price cap and the basis for accepting a finding before testing starts. The price for each severity level is fixed and published on this page.
Scope is counted in applications, APIs and endpoints, not by company size. A larger scope gets an individual cap, agreed before testing starts.
How severity works
We assess vulnerability severity using the Common Vulnerability Scoring System (CVSS). Each assessment includes the CVSS version, score and scoring vector so the basis for the rating can be reviewed. The descriptions below are illustrative; each finding is scored according to its impact and exploitation conditions.
- Critical$700
- Potentially extensive compromise, such as broad access to sensitive systems or data under achievable conditions.
- High$400
- Substantial unauthorized access or impact, potentially subject to prerequisites.
- Medium$150
- Meaningful but more limited impact, or exploitation requiring more restrictive conditions.
- Low$50
- Limited impact or a narrow opportunity for exploitation.
- Informational and hardeningFree
- Observations and hardening advice that are not exploitable vulnerabilities. Always reported, never billed.
What counts toward the fee
The fee is based on confirmed vulnerabilities and their severity. Several manifestations of the same root cause count as one finding, priced at the highest severity among them. Vulnerabilities you tell us about before testing are not billed. A disputed finding is not billed until the dispute is resolved.
No confirmed vulnerabilities means no audit fee. It does not certify that the tested systems are vulnerability-free.
Your next step
Share the assets you want tested, whether authenticated access is available and any target dates. We can then agree the scope and the cap.
Read the engagement overview