There's no single number that fits every business. Cost depends on how much you're asking us to look at, how deep you want us to go, and how often you want it done.
This guide walks through the real cost drivers, how quoting typically works in practice, and a few ways to get more value out of whatever budget you're working with.
The single biggest factor is scope: how many IP addresses, hosts, applications, and cloud assets are actually being assessed. A five-person startup with two servers and a marketing site is a fundamentally different engagement from a 200-person company running a mix of on-prem infrastructure and cloud services across multiple business units.
Beyond raw asset count, whether you want internal network coverage, external-facing systems, or both changes the picture. External-only assessments are usually faster and cheaper, since they don't require the same level of access negotiation and internal coordination that a full internal review does.
We don't publish a flat rate because it would either overcharge simple environments or undercharge complex ones, and neither outcome is fair to you. Instead, a short discovery call lets us understand your environment — what you're running, where it lives, and what's driving the need for the assessment in the first place.
From that conversation you get a written estimate before anything is booked, covering scope, timeline, and price. There's no pressure to commit on that first call; the point of the discovery conversation is to get you an accurate number, not a rushed signature.
If budget is the limiting factor, prioritizing external-facing systems first is a reasonable place to start, since that's typically where the highest-likelihood attack paths originate. Internal coverage can follow once you've addressed the most exposed layer.
Bundling a retest into the original scope is almost always cheaper than booking it as a separate engagement later, because the context and access negotiation from the first assessment carries over. If you know you'll want confirmation that fixes worked, say so during scoping rather than treating it as an afterthought.
The most common cost mistake is scoping too broadly out of caution, then paying for coverage of low-risk assets that could have waited for a later phase. A tightly scoped assessment of your highest-risk systems, done well, beats a loosely defined "assess everything" engagement that spreads attention too thin.
The second most common mistake is treating each assessment as a one-off with no continuity. Starting from scratch every time costs more in aggregate than committing to a recurring cadence, where each engagement builds on institutional knowledge from the last.
Most assessments are quoted as a project fee based on total scope, not a strict per-asset rate, since some assets take far longer to assess than others and a rigid per-asset model would misprice both simple and complex environments.
Recurring engagements (quarterly or annual) are often more cost-effective than repeated one-off bookings, since we're not re-scoping from scratch each time and can build on prior findings.
A written quote covers the assets in scope, the methodology, the expected timeline, whether a retest is included, and total price — everything you need to compare it against another vendor's proposal.
Yes. Many clients start with external-facing systems and expand to internal coverage in a later phase once budget and priorities allow.
Compliance-driven assessments sometimes require specific documentation formats, which can add modest time to reporting, but the core assessment work itself is priced the same way regardless of the driver.