# Pricing: fixed-price VAPT and AI security testing from $3,000

Canonical page: https://dxcl.tech/pricing/ . Machine-readable: https://dxcl.tech/pricing.json

Fixed prices, agreed in writing before testing starts. Half when you approve the scope, half when we deliver the report. The first check of your fixes is included. Prices are in US dollars.

## Tiers
- **Starter VAPT, $3,000 to $5,000:** one web app or API. Good for a first test before a fundraise or launch.
- **Standard VAPT, $6,000 to $8,000:** app, API and cloud together. The usual fit for Series A teams.
- **AI or IoT, $8,000 to $10,000:** LLM features, agents, or a connected device and its firmware.
- **Enterprise, from $25,000:** multiple products and surfaces, scoped around your roadmap.

## Every engagement includes
- A 30-minute scoping call and a fixed price in writing within 48 hours
- Automated attacks plus manual testing of every page and endpoint in scope
- Certified testers you talk to directly
- A technical report and a managerial report by day 12 to 14
- A live walkthrough of every finding
- Support for your developers while they fix
- A check that your fixes hold
- A certificate valid for 3 to 6 months, verifiable at https://dxcl.tech/trust/

## Retests and annual contracts
- First check of your fixes: included.
- A later full retest, for example to renew an expired certificate: 70% of the original fee.
- Annual contract (three scheduled tests and one ad hoc test a year): 50% of the original fee per retest.

## What testing costs elsewhere
Market figures from published 2026 pricing guides and industry timelines (indicative):
- A typical penetration test: about $18,300 on average; $10,000 to $30,000 for most engagements (Synack, 2026 pricing guide). 4 to 6 weeks from planning to final report (Halock Security Labs, 2024).
- A web app or API test: $5,000 to $30,000 or more depending on complexity (Synack, 2026). 4 to 5 weeks on average (Schellman, 2024).
- A web app VAPT in India: INR 40,000 to 3.5 lakh depending on complexity; quotes under INR 20,000 to 40,000 are usually automated scans, not manual tests (Tranquility Cybersecurity, 2026; CyberSigma Consulting Services, 2026). 1 to 3 weeks of testing plus reporting (Tranquility Cybersecurity, 2026).
- DXCL: $3,000 to $10,000 for most engagements, Enterprise from $25,000, fixed in writing; report by day 12 to 14; technical and managerial reports, walkthrough, support while fixing, fix check and a verifiable certificate.

## The cost of not testing
- INR 25.5 crore: average cost of a data breach in India, a record high (IBM, Cost of a Data Breach 2026: India).
- INR 250 crore: maximum DPDP Act penalty for failing to take reasonable security safeguards (Press Information Bureau, 2025).
- 4% of worldwide annual turnover, or EUR 20 million if higher: the top GDPR fine (GDPR Article 83(5)).
- 43 days: median time to fully fix a critical, actively exploited vulnerability in 2025 (Verizon DBIR 2026).

## Questions
- **Are prices fixed?** Yes. You get a fixed price in writing after the scoping call, before any testing starts. It does not change unless you change the scope.
- **How is payment structured?** Half when you approve the scope, half when we deliver the report.
- **What does a retest cost?** The first check of your fixes is included. A later full retest, for example to renew an expired certificate, costs 70% of the original fee, or 50% on an annual contract.
- **Who does the testing?** Certified security testers, the same people you meet on the scoping call. No account managers sit between you and the people who find and explain the issues.