Real starting points for a typical mid-sized estate. What moves them is scope and complexity, never who you are.
Exposure monitoring and qualified alerting for organisations starting a security programme.
The full posture: continuous detection, contractual incident response and regular offensive campaigns.
For operators of vital importance and environments under strict sovereignty requirements.
No retainer required. Each of these includes the ninety-day re-test.
| Engagement | Scope | Duration | From |
|---|---|---|---|
| External penetration test | Internet-facing perimeter | 2 weeks | €9,500 |
| Internal penetration test | Assumed-breach, lateral movement | 3 weeks | €14,000 |
| Web application assessment | Per application, authenticated | 2 to 3 weeks | €11,000 |
| Red team engagement | Objective-based, multi-vector | 6 to 10 weeks | €38,000 |
| Cloud posture review | Per provider, all accounts | 3 weeks | €15,000 |
| ISO 27001 gap analysis | Full Annex A coverage | 3 weeks | €12,000 |
Because the alternative wastes three meetings establishing whether we are in the same range. The numbers here are honest starting points for a typical mid-sized estate.
Estate size, the number of distinct environments, regulatory scope, and whether testing must run inside restricted change windows. Not the logo on the door.
Retainers run on twelve-month terms, billed monthly or annually. One-off engagements have no term. We do not use auto-renewal clauses that require notice to escape.
No. It exists so both sides can decide whether to proceed, which is not something we think you should pay for.