Buying guide
Pentest cost: how to scope a quote
Effort drivers, illustrative scopes and terms to compare Web/API pentest proposals without invented price ranges.
A quote starts with scope
REKON prepares proposals against an agreed scope. We do not publish a universal rate: a public website and a multi-tenant payment API require different tests. To request a quote, describe assets, user types, critical workflows and target date. No secrets are needed.
What changes the effort
Roles and tenants: every authorization boundary adds scenarios. Workflows: signup, payments, refunds and approvals create states to examine. Integrations: clarify who can authorize each system. Readiness: incomplete accounts and unstable environments reduce useful testing time. Depth: a focused review and a broad assessment provide different coverage. Retesting: agree on the window, included findings and handling of changes.
Three illustrative scenarios
Customer portal: login, recovery and documents; accounts from the same and another customer. Multi-tenant SaaS: members, administrators, invitations, exports and organization isolation. Payment API: creation, confirmation, cancellation and retries using test funds. These are examples for scoping, not commercial packages or time estimates.
Compare total cost
Request written terms covering assets and exclusions, effort and schedule, required accounts, deliverables, urgent finding communication, retest terms, scope changes, currency, taxes and payment. A cheaper proposal may cover less. A higher price does not prove greater depth: ask for a sample report and an explanation of the method.
Turn your scenario into a proposal
Use the readiness checklist and provider selection guide. Then request a proposal with non-sensitive context.
Straight answers
How do I request a proposal?
- Share the application type, roles and objective through the contact form. Do not send credentials or customer data.
Does a pentest guarantee security?
- No. It evaluates an agreed scope and version within a testing window. Limitations and residual risk remain.
What is agreed before testing?
- Assets, permissions, environments, exclusions, communication, deliverables and retest terms.
Time to test your doors?
Tell us what needs validating. We answer with proposed scope, not a brochure.