Startup SaaS before a first enterprise deal
One web application, three user roles, the API behind it, mapped to SOC 2. Typically a 48-hour report.
48-hour pentestPricing · Fixed scope · Retest included
VAPT pricing at Sumrite: a fixed quote for your scope.
Sumrite does not sell penetration tests from a price list, because the effort depends on your application, not on a page count. Here is exactly what drives the price, what is always included and how to get a fixed quote.
Fixed priceAgreed before testing starts, for a written scope.
Always includedNDA, expert-verified findings, fix guidance and a retest.
No surprisesAnything out of scope is listed in the quote.
The cost of a penetration test depends on how many expert testing days your scope needs: the number of applications, APIs, user roles and hosts, how deep the testing goes, the environment, and the compliance mapping required. Sumrite turns your scope into a fixed price before testing starts, and every quote includes an NDA, verified findings, fix guidance and a retest.
What drives the cost of a penetration test
| Driver | Why it changes the effort |
|---|---|
| Number of applications, APIs and hosts | Each one needs its own mapping, testing and write-up |
| User roles and tenants | Access control is tested between every pair of roles and tenants |
| Testing depth | Grey box with accounts, or white box with source code, finds more and takes longer than black box |
| Business logic | Payments, approvals and multi-step workflows need careful manual testing |
| Environment | A stable staging copy is faster to test than a fragile or production-only system |
| Compliance mapping | Mapping to SOC 2, ISO 27001, PCI DSS, NCA, DPDP or a regulator format adds reporting work |
| CERT-In empanelled report | Needed only when a regulator, ministry or contract asks for it |
Always included in a Sumrite quote
- An NDA signed before any technical detail is shared
- Expert-led testing, with every finding reproduced and verified
- CVSS severity, evidence and step-by-step reproduction for each finding
- Fix guidance for your stack and direct access to the tester
- A retest of fixed findings and an updated final report
- A report in your company name, ready for auditors and buyers
Three example scopes
Fintech with web, mobile and API
A customer web app, Android and iOS apps and the shared API, mapped to RBI or SAMA expectations.
Mobile app VAPTEnterprise annual programme
Several applications, external and internal networks and cloud accounts, tested on a schedule with PTaaS.
PTaaSHow to get a fixed quote
- Tell us what to test. URLs, apps, APIs, IP ranges or cloud accounts, and who is asking for the report.
- Sign the NDA. Before any technical detail is shared.
- Receive a fixed-scope quote. The price, what is in scope, what is out of scope and the timeline.
- Testing starts. Once the testing authorisation and test accounts are in place.
Frequently asked questions
Why doesn’t Sumrite publish prices?
Because two applications with the same number of pages can need very different effort. A fixed quote for your scope is more accurate than a price list, and it does not change once testing starts.
How much does a penetration test cost?
It depends on scope, roles, depth and environment. The VAPT cost guide lists the factors and published market figures for comparison.
Is the retest extra?
No. A retest of fixed findings is included on standard engagements.
Do you quote in rupees, riyals and dirhams?
Sumrite quotes in the currency that suits the contracting company, including Indian rupees, Saudi riyals, UAE dirhams and US dollars.
Related
Get a price for your scope
NDA first, fixed-scope quote, retest included.