Each starting price assumes one defined product, complete intake and written authorisation. Roles, workflows, integrations and delivery requirements determine the final scope.
Start at €490 for a simple public website. Authentication, custom APIs, checkout, separate applications or material business logic move the engagement to the appropriate application scope. We price the product boundary, not an arbitrary endpoint count.
A fixed-scope assessment for a public website on one technology stack. It covers the root domain, www and up to five owned subdomains that belong to the same website.
For a standard web application with one authenticated role, its directly consumed API and up to three critical workflows. Separate admin apps, complex SSO, multi-tenancy and additional roles require a larger scope.
Complete one structured intake, upload the evidence you already have, and receive an expert-validated security map and 90-day roadmap. Work starts when the required inputs are complete; clarification stays asynchronous.
One asynchronous intake for one product. We map architecture, data flows, access, security exposure and relevant regulatory risk, then deliver an expert-validated 90-day roadmap.
Choose the smallest application scope that covers the product boundary, authenticated roles, API surface and business logic under test. Focused Validation starts at €7,500; Full Application Pentest starts at €15,000.
A small web application or bounded API, up to two authenticated roles, with Argus-assisted testing and expert validation.
One web application and its primary API, including authentication, up to four roles, business logic and tenant isolation.
Repository and pull-request assurance for teams that want security feedback where changes happen, without pretending every commit needs a full pentest.
Continuous code assurance for a small product team.
Code assurance with specialist review and controlled pre-release validation.
Recurring evidence for one product without pretending that a pentester is permanently on call. Scheduled Argus runs surface change; human time is reserved for material findings and two focused testing windows each year.
Scheduled recurring validation for one product. Automation monitors change; bounded human review covers material findings, quarterly risk review and two focused manual windows.
AppSec Reviewed and Argus Sentinel for one protected product, joined through a shared evidence and remediation record.
Start with the smallest service that answers the decision in front of you. If the scope is already clear, go directly to Focused Validation or a Full Application Pentest.
Start Scoping
