For a release, compliance milestone or high-risk application.
For teams shipping frequently across multiple assets.
For broad attack surfaces and mature security teams.
Price depends on scope: the number of applications, APIs, hosts or cloud environments being tested, their complexity, the user roles and authenticated paths that need to be covered, the testing depth agreed (one-time, continuous, or managed), and whether retesting is included. We quote only after scope is agreed in writing, so the price matches the work.
A one-time pentest is scoped and priced for a specific target and release window (one web app, one API, one mobile build, or one network perimeter) and ends with a report. PTaaS is priced for a defined, ongoing scope with reusable testing capacity for new releases and changes, so the same retainer covers each cycle as your system evolves. For the service-level difference, see our PTaaS overview.
A defined scope across web, mobile, API, cloud or infrastructure; expert-led, methodology-driven testing; real-time critical-finding notification; an executive and technical penetration test report; actionable remediation guidance; comprehensive evidence and CVSS risk ratings; one complimentary retest after remediation; and live finding delivery. The package suits a release, compliance milestone or high-risk application.
Continuous security testing across your defined scope; reusable testing capacity for new releases and changes; automated coverage with expert-led validation; operator verification of every finding; on-demand retesting and validation; and continuous reporting with actionable remediation insights. It suits teams shipping frequently across multiple assets.
A fully managed bug bounty programme: a vetted researcher network; 24/7 triage and deduplication; finding validation and prioritisation; and programme operations and analytics. It suits broad attack surfaces and mature security teams. See the Bug Bounty programme for how it operates end to end.
Choose Focused if you need a point-in-time pentest for one application or release, or to satisfy a specific audit. Choose Continuous PTaaS if you ship regularly and want operator coverage that keeps up with changes rather than catching up once a year. Choose Managed if your attack surface is broad enough to need a researcher community, with scope, triage and payouts managed for you. Not sure? Send a short scope description and we will recommend the package that fits.
Yes. Many clients start with a Focused engagement for a specific release and move to Continuous PTaaS once the scope stabilises and change cadence picks up. The scope you confirmed for the one-time test transfers directly, and PTaaS adds reusable capacity for new releases from there.
Price scales with what is in scope, not with the hours it takes to execute. Related surfaces agreed in one engagement (a web application and the API behind it, two environments of the same app, or several Android variants) are usually priced together rather than as separate projects. Scope is written down before testing begins so there are no surprise additions.
The Focused one-time package includes one complimentary retest after remediation, with live finding delivery. Continuous PTaaS includes on-demand retesting and validation as part of the retainer. The Managed programme covers finding validation and prioritisation across the ongoing bounty scope. Any additional retests outside these entitlements are quoted on request.
No. There is no upfront payment to request a quotation. Share the scope (the systems, roles and depth you need covered) and we will come back with a tailored quote and timeline. If you need to start quickly, say so in the first message; a focused engagement can begin within an hour of scope sign-off.
The fastest way is the Get started form, which collects the scope details we need to quote: applications, APIs, hosts, user roles and the engagement model you are interested in. You can also email contact@pentesterspace.com with the same details, or use Schedule a meeting if you would rather walk through scope live.
This page covers the three engagement models. For service-specific pricing questions already answered on the site, see VAPT in Bangladesh, penetration testing in Bangladesh, API penetration testing and mobile app penetration testing. For engagement logistics, reports, timelines and certifications, see the main FAQ page.
