One-off penetration test
A focused test of the systems you choose, ahead of a launch, an audit or a major change.
What it includes
- Human-led, AI-assisted testing
- Proof and a fix per finding
- Report, briefing and one retest
Penetration testing pricing, set by your scope
Every penetration test is quoted on its scope, after a scoping conversation. The price follows the systems you run and the depth of testing they need.
Continuous testing
A full test every quarter, with checks between rounds on request as you ship.
A one-off test, plus
- Report and briefing each round
- One retest each round
What sets the price of a penetration test?
The price follows the amount of testing your systems need. Six things decide it, and we agree each one with you before the quote.
Applications and APIs
Each app, API or cloud account in scope adds its own attack surface.
Sample answer- app.acme-corp.com
- api.acme-corp.com
Environment and windows
We test live systems by default, inside windows you agree. Narrow windows spread the same testing over more days.
Sample answer- live
- weeknights
User roles
We sign in as each role, so every role adds authorisation paths to check.
Sample answer- customer
- support
- admin
Integrations
Single sign-on, webhooks and partner APIs add flows to test where they meet your systems.
Sample answer- single sign-on
- webhooks
Depth of testing
Business logic such as payments, approvals and refunds is worked by hand, step by step.
Sample answer- /checkout
- /refunds
Rounds and retest
One test with its retest, or rounds through the year with continuous penetration testing.
Sample answer- once
What a useful brief contains
A useful brief names what you run, who uses it and what we must leave alone. A few lines are enough, and we fill the gaps with you.
Please test our web app and its API:
app.acme-corp.comandapi.acme-corp.com.What you runApps, APIs or hosts, even roughly.
Customers, support staff and admins all sign in.
Who uses itThe kinds of user we should test as.
Please leave the payment provider alone.
What to leave aloneAnything we must not touch.
A new checkout goes live next quarter, and we want it tested first.
When, and whyA launch, an audit or a customer asking.
Sketch the size of your test
Size depends on the systems you name and how often you test. Answer three questions to sketch yours, and the answers carry into the quote form.
Your quote request
Request a quoteQuotes, scope and what is included
Anything else can go in the quote form. For the method, read how a GreySurface test runs.
Do you publish prices?
No. Each test is quoted on its scope after a scoping conversation, because two tests of the same kind can differ widely in size.
How quickly do you reply to a quote request?
Within one business day. We then agree the scope with you and send the quote.
What does the price include?
Every test includes proof of exploit and a fix for each finding, and an executive briefing for your leadership. It also includes one retest of the findings we reported, within 30 days of the report.
What does continuous testing include?
A full test every quarter, with checks between rounds on request. Each round brings its own report, briefing and retest.