Penetration testing prices before the first call.
Three ways to buy a test, with starting prices in your currency. Your quote is fixed after a scoping call and written down before any testing starts.
Prices for the United States and elsewhere.
Three packages
Each one is manual, authenticated testing with a report your customers’ reviewers can read and your engineers can act on.
Focused test
One web application or one API, before a release or a first customer review.
- One application or API, one environment
- Up to two roles, single-tenant or simple tenancy
- Report with shareable summary, one retest round
Product test
A multi-tenant SaaS product and its API, for enterprise reviews and audit evidence.
- Web application and its API together
- Up to five roles and full tenant-isolation testing
- SSO or SCIM where present, readout call, one retest round
Release programme
Teams that ship every week and answer security reviews all year.
- Two product-sized test windows, booked around your releases
- Change checks when a material feature ships between windows
- Retest after each window and a current report all year
What each package covers
Conditional means it is included when your product has it and the scope allows it, and the quote says which.
| Covers | Focused test | Product test | Release programme |
|---|---|---|---|
| Web application | Conditional | In scope | In scope |
| API | Conditional | In scope | In scope |
| Roles tested | Up to 2 | Up to 5 | Up to 5 per window |
| Tenant-isolation testing | Conditional | In scope | In scope |
| SSO and SCIM flows | Not applicable | Conditional | Conditional |
| Report with shareable summary | In scope | In scope | In scope |
| Readout call | Conditional | In scope | In scope |
| Retest | 1 round within 60 days | 1 round within 90 days | After each window |
| Checks between windows | Not applicable | Not applicable | In scope |
In scope included Conditional conditional Not applicable not part of the package
What moves the price
Price follows testing days, and testing days follow how much of your product a real attacker could reach.
- Roles and permissions
- Each role is tested against every other role. Five roles is far more pairs than two.
- Tenant model
- Multi-tenant products need every object checked across a tenant boundary, from two seeded tenants.
- API surface
- Endpoints the browser never calls, older versions and webhooks all count, not only what the UI shows.
- Integrations
- SSO, SCIM, payment providers and third-party callbacks each add flows that need their own tests.
- Environments and access
- A second environment, IP allow-listing or hardware-backed MFA adds set-up time before testing starts.
- AI features
- Assistants that read untrusted content or call tools are scoped separately; see AI application security.
Domain counts, page counts and lines of code are not on this list. They say little about how long a careful test of an application takes.
How the weeks run
Most of the calendar is your fixes, not our testing. Plan the retest around your release, not ours.
Quoted individually
This work does not fit a package, because the effort depends on things only a scoping call can tell us.
- AI application securityDepends on what the model can read and which tools it can call.
- Integration security reviewsSized by the number of identity providers, SCIM clients and callbacks.
- Investment security diligenceSized by the number of companies and whether light testing is authorised.
- Security engineeringScoped as a fixed piece of engineering work or a monthly allocation.
Buying from a particular country
Local requirements, invoicing and the hours we share with you, for the three markets we sell to first.
- IndiaRupee prices plus GST, the same working day, and what RBI, SEBI, the DPDP Act and overseas customers ask for.
- United KingdomSterling prices, shared morning hours, and what Cyber Essentials, ISO 27001 and UK GDPR do and do not ask for.
- United StatesDollar prices, how SOC 2, PCI DSS, HIPAA and NYDFS treat testing, and how calls work across the time difference.
The commercial terms
Every quote states
- The assets, roles, environments and exclusions in scope
- Testing days and the testing window
- The retest round and the window it must happen in
- Who receives the report, and in which versions
- The price in your currency, before taxes
What we need from you
- A signed scope and written authorisation from the system owner
- Test accounts for every role, in two tenants where tenancy is in scope
- A named contact for urgent findings during the window
- Agreement on the payment schedule in the statement of work
Pricing questions
How much does a penetration test cost?
At ZenoPentest, a manual test of one web application or API starts at $5,900, £4,900 or ₹1,49,000 before tax. A multi-tenant SaaS product and its API starts at $11,900, £9,500 or ₹2,95,000. An annual programme with two test windows starts at $22,500, £18,500 or ₹5,90,000. The price rises with roles, tenants, API size and integrations.
Why “from” and not a fixed price?
The starting price is what the package costs at the small end of its scope. Your quote is fixed after a scoping call, once we know the roles, tenant model, API surface and integrations. It does not change during the test unless you add scope in writing.
What counts as a role?
A distinct set of permissions a real user can hold: for example owner, admin, member and read-only. Two roles that differ only in a label count as one. Tenant-level and platform-level administrators count separately.
Which currency will I be quoted in?
Rupees for companies billed in India, pounds sterling for the UK and US dollars for everywhere else. The price is set for each market rather than converted at the day’s exchange rate, so it does not move with currency markets.
Are taxes included?
No. Indian prices are shown before GST. UK and US prices exclude VAT and any other taxes. Invoices are issued by Zeno Ventures Pvt. Ltd., the Indian company that owns ZenoPentest.
What if our scope is bigger than the package?
Then the quote says so and states the extra testing days and why. Large products are often better split into two tests around two releases, which also gives you two current reports instead of one.
Is the retest really included?
Yes, one round on the findings in the report, within the window shown for the package. A retest checks the fixes for reported findings. New features or a changed scope are a new test.
Do agencies pay the same?
The price for a test is the same whoever buys it. How an agency resells, refers or co-delivers is set out on the partnership page and agreed per project.
Get a fixed quote for your scope.
Tell us the product, the roles and the deadline. We reply with questions, then a written quote.