OWASP Top 10 testing
Web applications against the most common risk categories.
home / services
services
Penetration testing services: scope, deliverables and pricing
The analysis is AI-assisted and controlled, and a person reviews every result. Pick the type that fits your case: each sheet explains what it covers and what you need to start.
API testing
REST and GraphQL endpoints: authorisation, authentication, exposed data.
Mobile app testing
Package analysis and dynamic tests on a test device.
Cloud review
Identity, permissions, storage, network and logging. Read-only.
Infrastructure testing
Exposed services, versions, TLS, segmentation. External and internal.
Access and business logic
Access across roles and users, flows and business rules.
Private bug bounty
Verified researchers on a signed scope. You pay only for validated evidence.
catalogue
Who does the work, what we deliver, what it costs.
| Service | Who does it | What we state | Indicative price |
|---|---|---|---|
| Vulnerability assessment | AI-assisted scan, reviewed by a person | Inventory and priorities. It is not a penetration test | To be set after the first trial |
| OWASP Top 10 testing | AI-assisted analysis, reviewed by a person | OWASP categories of the edition agreed in the scope | from €1,500 to €3,500 |
| Access and business logic | Analysis with a role matrix, senior reviewer | The service a scanner does not cover | from €4,500 to €7,500 |
| API testing | Analysis with an API specification, reviewed by a person | Object-level authorisation and tokens | from €2,000 to €4,000 |
| Mobile app testing | Analysis on a test device, reviewed by a person | Only apps owned by the client | from €2,500 to €5,000 |
| Cloud review | Read-only analysis, reviewed by a person | No changes to the configuration | from €1,500 to €3,000 |
| Infrastructure testing | Analysis on signed ranges, reviewed by a person | External and internal, with VPN for internal | from €1,000 to €2,500 per range |
| Compliance evidence pack | Human reviewer | Auditor format | from €500 to €1,000 extra |
| Private bug bounty | Verified researchers and a human reviewer | The client pays only for validated evidence | Fee and reward per validated issue, on quote |
One rule. A vulnerability assessment finds and ranks weaknesses. A penetration test shows whether a weakness can be exploited. That is why the two services have different prices and deliverables.