How Penetration Testing Is Scoped & Priced for Startups
Every startup architecture is different, which is why serious penetration testing is scoped on a short technical call rather than sold from a generic price list. Here is what drives a pentest quote, how our three plans work, and how to avoid paying for things you do not need.
When teams ask what a penetration test costs, the honest answer depends on the attack surface a senior researcher needs to test by hand. A focused single-role web application requires a very different level of effort than a multi-tenant platform with mobile apps, cloud infrastructure, and AI agent workflows.
Instead of publishing arbitrary numbers or locking you into an annual platform subscription, Sayfer scopes every engagement on a 30 minute call with our senior team. Right after the call, you receive a fixed-scope quote matched to one of our three plans (Lite in 2 weeks, Premium in 4 weeks, or a customized Elite plan), with unlimited retests included in every engagement.
The 5 Factors That Shape Your Pentest Scope
What we review together on our 30 minute scoping call.
| Scoping Factor | Focused Scope (Lite Plan: 2 Weeks) | Deeper Scope (Premium Plan: 4 Weeks) |
|---|---|---|
| 1. Testing guidelines & depth | Identify your most critical issues first using OWASP Top 10 guidelines | Identify complex, hidden risks using OWASP WSTG v4.2 and OWASP MSTG v1.4 guidelines |
| 2. Attack surfaces in scope | Focused web application and API boundary | Broader web, API, mobile (iOS and Android), cloud, or AI agent surfaces |
| 3. User roles & tenant model | Straightforward authentication and role structure | Multi-tenant architecture with complex roles, permissions, and business logic |
| 4. Additional assessments | Core manual penetration testing and remediation retests | Also includes Risk Assessment, Vendor Assessment, Reconnaissance, and Security Consulting |
| 5. Compliance certifications | Standard certifications: ISO 27001 and SOC 2 | Standard certifications: ISO 27001, SOC 2, HIPAA, PCI DSS, and more |
Fixed-Scope Engagements vs. Subscriptions
What often inflates pentest quotes elsewhere
- Annual platform subscriptions or credit packages when you only need one audit-ready test
- Open-ended hourly billing where extra days create unexpected invoices
- Additional charges or credit deductions when you need a retest after fixing vulnerabilities
- Account-manager handoffs where you never speak directly with the people testing your code
How Sayfer structures every quote
- A detailed fixed-scope quote covering prices, milestones, and deliverables after one short call
- Clear choice between Lite (2 weeks), Premium (4 weeks), and Elite (custom scope)
- Unlimited retests after fixes are implemented, included in every plan
- Direct communication with senior researchers augmented by our OffensiveVector agentic model
Sayfer in Numbers
Judge the output yourself: see a real report excerpt or review our three pen test plans.
FAQ
Common questions from CTOs, CISOs, and compliance leads.
Why does Sayfer send a quote after a call instead of listing prices on the website?
Because two startups of the same size can have completely different attack surfaces. A short scoping call lets us size the engagement to your actual endpoints, user roles, and compliance goals, so you only pay for the scope your product and auditor actually need.
What is the difference between the Lite, Premium, and Elite plans?
Lite takes 2 weeks, follows OWASP Top 10 guidelines, and covers ISO 27001 and SOC 2 readiness. Premium takes 4 weeks, follows OWASP WSTG v4.2 and MSTG v1.4 guidelines, covers ISO 27001, SOC 2, HIPAA, and PCI DSS, and adds Risk Assessment, Vendor Assessment, Reconnaissance, and Security Consulting. Elite is a customized plan that can also include full internal/external network scanning, architecture security audits, and security product reviews.
Are retests really unlimited in every plan?
Yes. Unlimited retests after fixes are implemented are included in Lite, Premium, and Elite. We retest until every finding is confirmed closed and issue your Sayfer certification.
Do we have to sign an annual subscription?
No. You pay for a defined scope with no annual platform subscription or credit lock-in.
What should we share on the scoping call to get our quote?
Tell us what your product does, which systems are in scope (web, API, mobile, cloud, AI agents, or smart contracts), which compliance framework you are targeting, and your target timeline.
Talk to the People Who Would Test You
One 30 minute call, directly with our senior team.
You will leave with a fixed quote and a clear timeline, whether you choose us or not.
