Security testing pricing
Find it before someone else does
We use our own AI tooling to sweep your external surface the way an attacker would, then a person reads every finding before it reaches you. Start with one audit. Each tier includes the one before it.
tier 1
External audit
$1,200one time
A point-in-time look at everything an attacker can see from the outside. Passive and non-intrusive, so nothing on your side breaks.
Book an audit- Up to 3 domains or apps: security headers, TLS, DNS and email authentication (SPF, DKIM, DMARC), exposed public files, third-party scripts and page source review
- A severity-rated PDF report with concrete fix steps and a prioritized checklist
- A 30-minute call to walk through the findings
- One retest after your team applies the fixes, within 60 days
5-business-day turnaround · extra domains $300 each
tier 2
Quarterly security review
$2,500per quarter
The external audit every quarter, plus the things that only show up when someone keeps watching.
Start quarterly reviewsEverything in the external audit, every quarter, plus:
- A diff report each quarter: new subdomains, header drift, new third-party scripts, certificate changes
- A rotating deep dive that goes one level further in one area each quarter: API surface, subdomain takeover sweep, dependency and version drift, email infrastructure
- Verification that last quarter's fixes actually landed
- A review of your DMARC aggregate reports
- Advisory access by email between audits, about an hour a month
3-quarter initial commitment, then rolling
tier 3
Best valueSecurity partner
$1,000per month
The retainer. Quarterly reviews, monthly monitoring, a yearly active test, and help with the security questionnaires that come with every deal.
Talk about a partnershipEverything in the quarterly review, plus:
- Automated checks every month for certificate expiry, header and DNS drift, new subdomains and email posture, with a human-reviewed summary
- An annual active-testing deep dive: authenticated app testing within an agreed scope, under a signed engagement agreement
- Vendor security questionnaire support, up to 4 hours a quarter
- Priority turnaround on ad-hoc questions
6-month minimum
The math
Why the retainer pays for itself
If you sell to government or enterprise buyers, the questionnaire help alone is worth a look. Those forms come with every deal, and we fill in the security sections with you.
Quarterly review
$10,000 / yr
Four audits, four diff reports and four deep dives.
Plus an active test
$14,000+ / yr
Authenticated app testing usually runs $4,000 to $6,000 on its own.
Security partner
$12,000 / yr
All of the above, monthly monitoring, and questionnaire help on top.
Coverage
What every audit checks
Headers and TLS
Security headers, certificate setup, protocol and cipher support.
DNS and email
SPF, DKIM and DMARC, plus the DNS records people forget about.
Exposure
Public files and paths that shouldn't be reachable, and subdomains you may not know you have.
Supply chain
Every third-party script your pages load, and what it's allowed to do.
Page source
Comments, keys, internal URLs and debug output left in what you ship.
The audit and quarterly reviews are passive. We only look at what anyone on the internet can already reach, so there's nothing to schedule around. Active testing happens only on the partner tier, inside a scope we agree on in writing first.
Not sure where to start?
Book the one-off audit. The report will make it clear whether you need anything more.
Ready to see what an attacker sees?
Book a $1,200 external audit