Typical engagement duration: 2–3 weeks depending on scope and access.
Pricing starts from $1000.
Designed for customer security reviews, procurement, and SOC 2/ISO vendor requirements.
Includes a professional pentest report you can use for Vendor Risk Assessment Questionnaires (security questionnaires, vendor onboarding, and customer due diligence).
Clear scope, manual testing, and reporting built for engineering teams and leadership. Every finding is validated and documented with actionable remediation steps.
Manual testing of your web application and API endpoints focused on exploitable vulnerabilities, real business impact, and practical remediation guidance your engineers can act on immediately.
Fixed-scope packages designed for startups and SaaS products. Pricing is shown in EUR. USD pricing is +20% due to currency handling and billing overhead.
Retesting: €40/hour
Additional endpoints:
€80+ per endpoint (beyond 60) · USD: $96+
Retesting:
€40/hour
Executive-ready + engineering-friendly. Evidence, impact, and fix guidance — not scanner output.
Requests/responses, screenshots, and clear steps your team can verify fast.
Prioritized by real risk so leadership and engineers focus on what matters.
Practical fixes aligned with your architecture and API patterns.
Clear engagement rules, predictable communication, and responsible handling of evidence and sensitive data.
Written authorization, safe testing, and clean evidence handling.
Testing is performed only with explicit written authorization and defined Rules of Engagement.
Non-destructive validation. No downtime or stress testing unless agreed.
Report format works for SOC 2 / ISO onboarding and customer security questionnaires.
In-scope assets, exclusions, and rules of engagement are confirmed before testing begins.
Fix validation and retesting available to confirm remediation and reduce re-opened findings.
Black-box testing focused on real-world exploitation paths, validated findings, and practical remediation. This engagement is designed for internet-facing applications and APIs (not internal network testing).
Testing your application from an attacker perspective using only the access you provide (URLs, accounts, and approved scope). The focus is on exploitable vulnerabilities, business logic abuse, and authorization flaws that can lead to account takeover, data exposure, or privilege escalation.
Testing can be performed on Staging or Production (based on your preference). If authenticated workflows are required, you may need to provide test accounts/credentials.
Login flows, session handling, password reset, token security (JWT/refresh tokens), and common bypass paths.
IDOR/BOLA, role bypass, privilege escalation, and tenant isolation issues in both web and API endpoints.
Sensitive information leakage, misconfigurations, and workflow abuse scenarios relevant to your product.
To keep testing safe and predictable, the following areas are not included unless explicitly agreed.
If your requirements include internal network testing, I can discuss a separate scope.
Share a few details about your application and timeline. I will respond with a recommended scope, estimated effort, and a fixed-price quote.
To help me scope accurately, include: target URL(s), environment type (prod/staging), authentication type,
estimated number of API endpoints, and any compliance requirements (SOC 2, ISO 27001, etc.).
Note: Testing is performed only with explicit written authorization and a defined Rules of Engagement.