Priced around
what you run.
There is no single price, because a ten-system scope and a thousand-system scope are not the same job. Pricing follows your attack surface, how often you want testing, and the depth of reporting you need.
Project testing
Targeted testing for a specific system, a product launch, or an audit you have to answer this quarter.
Scoped per engagement
- Testing on request
- Standard triage
- Executive and technical reports
- Mapping to ISO 27001 and SOC 2
- 5 working day triage target
Continuous programme
Testing that runs all year, with findings, owners and retests tracked in one place instead of a report per year.
Scoped per engagement
- Continuous exposure testing
- Priority triage
- Unlimited people on the platform
- Mapping to NCA and SAMA frameworks
- Retest validation on every fix
- API and webhook integration
Regulated and government
For environments where deployment, approvals and auditability matter as much as the testing itself.
Scoped per engagement
- Full red team exercises
- A named point of contact
- Your own finding categories
- Board-level risk reporting
- Data export and reporting tools
- Advisory sessions
What each model includes
| Capability | Project | Continuous | Regulated |
|---|---|---|---|
| Platform access and dashboard | |||
| Executive and technical reports | |||
| Standard triage (5 working days) | |||
| Mapping to ISO 27001 and SOC 2 | |||
| Continuous testing | |||
| Priority triage | |||
| Mapping to NCA and SAMA frameworks | |||
| API and webhook integration | |||
| Unlimited people on the platform | |||
| Red team exercises | |||
| A named point of contact | |||
| Your own finding categories | |||
| Board-level risk reporting | |||
| Advisory sessions |
How is the price worked out?
Three things: how much you expose, how often you want it tested, and how specialised the testing has to be. We scope it with you before anything is quoted.
Do you work with government entities?
Yes. For those engagements the platform can be deployed so that data, evidence and reports stay inside the Kingdom, with approval steps on every stage.
Can the scope grow later?
Yes. Scope and researcher allocation can be extended mid-programme as your systems grow, without restarting the engagement.
What happens to a finding after it is reported?
A researcher validates it by hand before you see it. It then stays open with an owner and a due date until a retest confirms the fix.