Bloomwiz Security · Pricing
Application security testing pricing
Price your security assessment before you talk to anyone. Application security testing, priced on scope, in US dollars or Indian rupees. Build your request and send it to us with your details. We come back with a formal quote and a written proposal covering exactly the scope you selected.
- All inclusive price
- No platform fee, licence charge or minimum retainer
- Retests at 25 percent per iteration
- USD or INR
How it works
Three steps down one page
- 01
Configure an assessment
Step 01. Choose your approach and scope and watch the price change as you adjust it.
- 02
Build your request
Step 02. Added lines are listed with quantity controls and a running total, so several assessments with different approaches or scopes can go into one enquiry.
- 03
Send your details
Step 03. Add contact and organisation details and receive a referenced request.
The price is all inclusive. Testing, project management, reporting and senior review are bundled into the one number, and there is no platform fee, licence charge or minimum retainer.
Configurator
Configure your assessment
Approach comes first because it changes everything after it. Grey box is credentialed, so user roles are priced. Black box has no credentials, so the user roles field disappears and only page count matters.
Anything above 100 pages, or above 10 user roles on a grey box assessment, falls outside the menu. The page asks for a scoping call rather than producing a figure it cannot stand behind.
01 Configure an assessment
Grey box, small · Up to 20 pages, up to 3 user roles
$460
Assessment $368 + 1 × retest $92
All inclusive: testing, project management, reporting and senior review.
02 Your request
Nothing added yet. Configure an assessment and choose “Add to request”. You can add several, each with its own approach and scope.
An estimate from the published price list. We confirm it in a formal quote and a written proposal.
Price list
The price list
Black box is flat to 100 pages, because without credentials the reachable surface does not grow the way a credentialed one does. It is the cheapest option here and also the one that finds least, since nothing behind a login is reached at all. Unless you specifically want an outsider’s view of your perimeter, grey box is what we will recommend.
| Approach | Scope | USD | INR | Retest USD | Retest INR |
|---|---|---|---|---|---|
| Black box | Up to 100 pages, no credentials supplied | $316 | ₹30,000 | $79 | ₹7,500 |
| Grey box, small | Up to 20 pages, up to 3 user roles | $368 | ₹35,000 | $92 | ₹8,750 |
| Grey box, medium | Up to 50 pages, up to 5 user roles | $420 | ₹40,000 | $105 | ₹10,000 |
| Grey box, large | Up to 100 pages, up to 10 user roles | $524 | ₹50,000 | $131 | ₹12,500 |
| Beyond that | More than 100 pages, or more than 10 roles on grey box | Scoped | Scoped |
Each application is priced at its own scope. Rupee prices are a set price list, not a live conversion, so they do not move with the exchange rate.
Closing findings
Retests
A retest re executes against the original findings and gives you written confirmation of what is closed. It is charged per iteration at the rate in the table above and includes an updated report. Most clients need one. Some need two.
Inclusions
What the price includes
- Security testing against the agreed scope, with accounts for every user role where the approach is grey box.
- Manual reproduction of every finding. Anything we cannot reproduce is discarded rather than reported.
- A technical report with evidence, business impact, the specific fix and a verification step, scored on CVSS v4.
- An executive summary for the people funding the work.
- Technical review and sign off by practice leadership before the report is issued.
- A readout call to walk your team through the findings.
Exclusions
Quoted separately
- Remediation. Because we also build software, we can usually do it ourselves.
- Secure code review, mobile application security testing, infrastructure and cloud.
- API security testing as a scope of its own, rather than the APIs behind the screens being tested.
- Testing outside business hours, or against production where a maintenance window is needed.
Assumptions
What changes the price
The tiers assume one environment, test accounts available before the start date where the approach is grey box, and no network restrictions on the testing source. Tell us if any of that differs and we will requote rather than surprise you later.
Page count is counted as distinct functional pages or screens, not as URLs generated from data. A product catalogue with 10,000 items is one page.
FAQ
Frequently asked questions
How much does a penetration test cost?
For application security testing, published prices start at $316 or ₹30,000 for a black box assessment of up to 100 pages, and rise to $524 or ₹50,000 for a large grey box assessment. Everything beyond that scope is quoted.
What is a page for pricing purposes?
Pages are counted as distinct functional pages or screens, not as URLs generated from data. A product catalogue with 10,000 items counts as one page.
Why is grey box more expensive than black box?
Grey box testing is credentialed, so every user role needs an account and the testers can reach everything behind the login. It finds more, which is why we usually recommend it.
Is a retest included?
A retest is charged per iteration at 25 percent of the assessment price and includes an updated report. Most clients need one, and some need two.
Do the rupee prices change with the exchange rate?
No. Rupee prices are a set price list, not a live conversion.
Talk to us
Not sure which tier you need?
Send us the application and what you know about it. We will tell you which row of the price list it falls in, or scope it if it falls outside.