Penetration testing cost depends far more on what you ask the tester to test than on who you hire. A small marketing site with one login is a very different job from a fintech platform with five user roles, a public API and Android and iOS apps. Scope, depth and the quality of the report decide the price; the brand name on the proposal decides very little.
If you have been asked for a VAPT report by a client, an auditor or a regulator, this guide explains what drives VAPT pricing, why the cheapest quote is often the most expensive one, what to send a vendor to get an accurate quote, and how to bring the cost down without weakening the test. If you want a number right now, use our VAPT cost estimator and come back here to understand what sits behind it.
Key takeaways
- The biggest cost drivers are the type of target (web, API, mobile, network, cloud), its size and complexity, and the depth of manual testing.
- Grey-box testing with real test accounts usually gives the best value: deeper coverage than black box, without the effort of full white-box review.
- Scanner-only "VAPT" looks cheap but often fails client and audit scrutiny, so you end up paying twice.
- Send URLs, user roles, API docs or a Postman collection, app builds and environment details to get a fixed quote instead of a guess.
- Ask every vendor for a sample report, their methodology (OWASP WSTG, MASTG), CVSS scoring and whether a retest is included.
- Get an instant indicative figure with the VAPT cost in India estimator, then confirm a fixed quote after scoping.
What is included in penetration testing cost?
VAPT stands for Vulnerability Assessment and Penetration Testing. The vulnerability assessment part is broad and largely tool-assisted: it finds and lists known weaknesses. The penetration testing part is manual and deep: a tester tries to exploit those weaknesses, chain them together and prove real business impact, such as one customer reading another customer's data.
When you pay for VAPT you are mostly paying for skilled tester time: scoping, scanning, manual testing of logic and access control, verifying findings, writing an actionable report and retesting fixes. The more of the application a tester has to understand, the more time it takes, and that is what moves the VAPT price.
What drives VAPT cost in India
Every vendor prices slightly differently, but the same factors decide the effort. Knowing them helps you compare quotes fairly and spot one that is missing something.
Type of target
Web applications, APIs, mobile apps, networks and cloud accounts each need different skills and tools. A mobile test, for example, adds reverse engineering and local storage checks on top of the backend API. Testing several targets together costs more than one, but usually less than buying each separately.
Size and complexity
Size is not just the number of pages. What matters is how many functions, user roles, API endpoints, mobile screens or IP addresses must be covered. Every role needs testing against every other role for privilege escalation, and payment flows, file uploads, multi-tenant data and integrations all add time.
Black, grey or white box
In black-box testing the tester gets nothing but a URL, like an outside attacker. In grey-box testing they get test accounts for each role and some documentation. In white-box testing they also get architecture details or source code. Black box spends much of its time on discovery and can miss what sits behind the login, so grey box is the common choice for compliance-driven VAPT.
Manual depth versus automated scanning
Scanners such as OWASP ZAP or Burp Suite's scanner are good at finding known patterns quickly. They are poor at business logic, broken access control and chained attacks, which attackers exploit most. A mostly-scanning quote will be lower; a manual one reflects expert hours spent thinking like an attacker.
Retest, report quality and compliance mapping
A retest after fixes turns a list of problems into a clean report you can share; some vendors include it, others charge for it. Clear reproduction steps, evidence, CVSS severity scores and step-by-step fixes save your developers time. Mapping findings to OWASP categories, ISO/IEC 27001 Annex A control 8.8 (management of technical vulnerabilities) or a regulator's format adds effort but makes the report usable for audits.
Urgency, location and timing
A rushed deadline for a tender or go-live can mean more testers on one project, which raises the price. On-site testing for internal networks or restricted environments adds travel and logistics compared with remote testing, and out-of-hours testing on production can add cost too.
VAPT pricing drivers at a glance
| Cost driver | Pushes price up | Keeps price down |
|---|---|---|
| Target type | Web + API + Android + iOS + cloud together | A single, clearly defined target |
| Size and complexity | Many roles, endpoints, screens, integrations, payment flows | Few roles, limited modules, simple data model |
| Testing approach | White box with code and architecture review | Grey box with ready test accounts and docs |
| Manual depth | Business logic, chained attacks, every role tested | Mostly automated scanning (cheap but shallow) |
| Retest | Charged separately or multiple paid rounds | Retest included in the quote |
| Report and compliance | Custom mapping to several frameworks or formats | Standard OWASP-mapped report |
| Urgency | Report needed within a few days | Planned in advance with a flexible window |
| Location | On-site, out-of-hours or restricted environments | Remote testing on a staging environment |
Web, API and mobile app penetration testing cost
Each target type has its own effort profile, so it helps to know what is being measured when you ask for a quote.
Web application penetration testing cost is driven by the number of functional modules, user roles and complex features such as file uploads, payments and report exports. Testing follows the OWASP Web Security Testing Guide (WSTG) and covers risks such as those in the OWASP Top 10, from A01 Broken Access Control to A10 Server-Side Request Forgery. See how a web application penetration test is run.
API penetration testing cost depends on the number of endpoints, authentication methods and how much documentation exists. A Postman collection or OpenAPI file makes testing faster and more complete. Testers check issues in the OWASP API Security Top 10, such as API1 Broken Object Level Authorization and API5 Broken Function Level Authorization. More on our API penetration testing service.
Mobile app penetration testing cost depends on whether you need Android, iOS or both, how many screens and features the app has, and its backend API. Testing follows OWASP MASTG and the MASVS control groups, using tools such as MobSF, Frida, Jadx and apktool. Details on mobile application penetration testing.
For reference, Xtreme InfoSec's published starting prices are: web application from ₹30,000, API from ₹15,000, mobile app from ₹30,000 and network from ₹15,000. The final price is a fixed quote after scoping, because two "web apps" can differ enormously in size.
Need a budget figure for an approval or a tender? Answer a few questions about your app, API or network in the VAPT cost estimator to get an indicative cost in a minute, then request a fixed quote.
Why cheap scanner-only VAPT is a false saving
Some offers are simply an automated scan exported into a branded PDF. They are cheap, but they cost more later.
- They miss the issues that matter. Scanners rarely detect broken access control, IDOR (insecure direct object reference, where changing an ID shows someone else's data) or business logic flaws such as skipping a payment step.
- They are full of noise. Unverified findings include false positives, so your developers waste time on issues that are not real.
- They fail scrutiny. Clients and auditors who read reports closely can reject one with no manual evidence or methodology, and you pay for a second test under deadline pressure.
- They give false confidence. A clean scanner report on a vulnerable app convinces management the risk is handled.
The real question is not "what is the lowest VAPT price?" but "what does it cost to get a report that is accepted and actually reduces risk?"
How to get an accurate VAPT quote
Vague requests get padded quotes, because the vendor has to price in the unknown. Send:
- Targets: all URLs, subdomains, API base URLs, IP ranges or cloud accounts in scope, and anything explicitly out of scope.
- User roles: a list of roles (for example admin, staff, customer) and whether you can create test accounts for each.
- API details: an OpenAPI/Swagger file or a Postman collection, the number of endpoints and the authentication method (session, JWT, OAuth, API keys).
- Mobile builds: APK and IPA or TestFlight access, the platforms needed and whether the backend API is also in scope.
- Environment: staging or production, any IP allow-listing or VPN access, and testing windows.
- Purpose and deadline: client questionnaire, ISO 27001 audit, RBI or SEBI requirement, tender or app launch, and the date you need the report.
- Report requirements: any specific format, framework mapping or auditor criteria. Some regulators and clients ask for a CERT-In-empanelled auditor, so check your requirement before you request quotes.
Regulators such as RBI and SEBI expect regulated entities to run periodic VAPT; scope and frequency depend on your circular, so share it with the vendor.
Questions to ask before you compare VAPT pricing
Two quotes are only comparable if they buy the same work. Ask each vendor:
- Can we see a sample (redacted) report?
- Is every finding manually verified, and how much of the test is manual versus automated?
- Which methodology do you follow: OWASP WSTG for web, OWASP MASTG for mobile, the OWASP API Security Top 10 for APIs?
- How do you rate severity? Do you use CVSS (v3.1 is widely used; v4.0 was published in 2023)?
- Is a retest included after we fix the issues, and how many rounds?
- Will all user roles be tested against each other for privilege escalation?
- Does the report include reproduction steps, evidence and clear remediation guidance?
Hidden costs to watch for
The quoted VAPT cost is not always the total cost. Watch for:
- Paid retests: a low headline price with every retest charged separately.
- Scope creep charges: extra fees when the vendor discovers a subdomain, role or module that was not listed.
- Report re-formatting: charges for converting the report to an auditor's or client's format.
- Your internal time: developers chasing false positives from an unverified report.
- A second test: the biggest hidden cost, when the first report is rejected and you must repeat it before a deadline.
How to reduce penetration testing cost without cutting quality
- Scope precisely. Test what the client or auditor actually needs, and exclude unchanged or retired systems.
- Prepare test accounts and docs in advance. Ready credentials for every role, a Postman collection and a stable staging environment cut wasted tester hours.
- Fix the basics first. Patch outdated components and obvious misconfigurations before testing, so the tester spends time on deeper issues.
- Combine web and API. Most web apps sit on an API; testing them together avoids duplicated discovery and usually costs less than two separate engagements.
- Use fix-then-retest. Choose a vendor whose quote includes a retest, fix quickly, and get a clean report in one cycle.
- Plan ahead. Booking before the deadline avoids rush charges.
At Xtreme InfoSec, every engagement is manual and expert-led, findings are verified by hand, and you get an OWASP-mapped report with step-by-step fixes plus a free retest after fixes. Timelines depend on scope and are confirmed in the quote.
Frequently asked questions
How much does penetration testing cost in India?
It depends on the target type, size, number of user roles, testing depth and whether a retest is included. Xtreme InfoSec's published starting prices are web app from ₹30,000, API from ₹15,000, mobile app from ₹30,000 and network from ₹15,000, with a fixed quote after scoping. Use the VAPT cost estimator for an indicative figure for your scope.
Why do VAPT quotes vary so much between vendors?
Vendors are often quoting different work. One may be pricing an automated scan, another a full manual grey-box test of every role with a retest. Ask for a sample report, the methodology and the retest terms so you compare like with like.
Is automated vulnerability scanning enough for compliance?
It rarely is. Scanners miss access control and business logic flaws, and many clients and auditors expect evidence of manual penetration testing. Treat scanning as one input to VAPT, not a replacement for it.
Does the VAPT price include a retest?
It depends on the vendor, so always ask. A retest confirms your fixes work and gives you a clean report to share. At Xtreme InfoSec a free retest after fixes is part of every engagement.
What information do I need to get a VAPT quote?
Share the URLs, API documentation or Postman collection, mobile app builds, user roles, environment details, purpose and deadline. The clearer the scope, the more accurate and fixed the quote.
Estimate your VAPT cost in minutes
Tell us about your web app, API, mobile app or network and get an indicative cost instantly. When you are ready, we will scope it properly and send a fixed free quote.