Pricing
How much do your security services cost?
AAVETech prices on a fixed-scope basis rather than hourly. A single web application penetration test typically lands between ₹45,000 and ₹1,20,000, mobile and API work sits higher, and retainers run from ₹35,000 per month. Every quote is confirmed in writing before work starts, and a retest after remediation is included on assessment engagements rather than sold as an extra.
Key takeaways
- Fixed scope, fixed price. We do not bill by the hour for assessment work.
- A retest after remediation is included on every assessment engagement.
- Retainers include priority response and scheduled testing rather than only a hotline.
- Emergency incident work is priced per incident, starting at ₹35,000.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What are the price bands by service?
These are indicative bands for a typical scope. The final figure depends on the number of assets, depth of authentication, number of environments and the deadline. We confirm a fixed price in writing before any work begins, and it does not move unless the scope changes — in which case we tell you first.
| Service | Indicative band | Typical turnaround |
|---|---|---|
| VAPT & penetration testing | ₹45,000 – ₹3,50,000 | 5–10 working days |
| Web application security testing | ₹45,000 – ₹2,50,000 | 5–10 working days |
| Mobile app security testing | ₹60,000 – ₹2,50,000 | 7–12 working days |
| API security testing | ₹50,000 – ₹2,00,000 | 5–10 working days |
| Network penetration testing | ₹75,000 – ₹3,00,000 | 7–15 working days |
| Cloud security assessment | ₹80,000 – ₹3,50,000 | 7–12 working days |
| Cyber security audit & gap assessment | ₹60,000 – ₹4,00,000 | 10–20 working days |
| Incident response (per incident) | From ₹35,000 | Under 4 hours for retainer clients |
| Ransomware recovery | ₹40,000 – ₹5,00,000 | Emergency, within 4 hours |
| Website malware removal | ₹15,000 – ₹75,000 | 24–72 hours |
| Deepfake protection retainer | ₹25,000 – ₹4,00,000 | Monitoring within 48 hours |
| Digital forensics | ₹30,000 – ₹2,50,000 | 7–20 working days |
| Account & data recovery | ₹5,000 – ₹50,000 | 24 hours to 7 days |
| Social media account security | ₹8,000 – ₹60,000 | 24–72 hours |
| Email security & BEC defence | ₹35,000 – ₹1,50,000 | 5–10 working days |
| Phishing simulation | ₹15,000 – ₹1,20,000 | Campaign live in 5 days |
| Awareness training (annual) | ₹18,000 – ₹2,00,000 | Live in 10 days |
| Bug bounty programme setup | ₹75,000 – ₹3,00,000 | 4–8 weeks to launch |
| Red team assessment | ₹1,50,000 – ₹8,00,000 | 3–6 weeks |
| Managed SOC (monthly) | ₹35,000 – ₹2,50,000 | Live in 10 days |
| VDP setup | ₹35,000 – ₹1,20,000 | 3–5 weeks |
| IoT & firmware testing | ₹80,000 – ₹4,00,000 | 2–4 weeks |
| DPDP Act & CERT-In readiness | ₹50,000 – ₹3,00,000 | 10–20 working days |
| Third-party risk assessment | ₹70,000 – ₹3,00,000 | 10–20 working days |
What engagement models do you offer?
| Model | How it works | When it suits |
|---|---|---|
| Fixed scope | A defined test against a defined estate, delivered to a date, at a fixed price. | A first assessment, a certification requirement, or a specific deadline. |
| Retainer | A monthly engagement with scheduled testing, priority response and quarterly reviews. | An ongoing security function you do not want to hire for. |
| Incident response | Priced per incident, engaged on demand, with a response SLA. | When something is already happening. |
| Managed service | A monthly fee for monitoring, triage and vulnerability management. | When you need a 24/7 watch but not a 24/7 team. |
| Embedded support | We work inside your team on a retainer, in your repositories and your tooling. | Product teams that want security in the design phase. |
What is always included?
- The scoping conversation, before the quote, so the price fits your estate.
- A written rules-of-engagement document signed by both sides.
- A live finding log during the engagement.
- A technical report with reproduction steps and a one-page executive summary.
- A retest after remediation, with each finding marked closed, partial or open.
What is charged separately?
Nothing is charged unexpectedly. Travel and accommodation for on-site work are billed at cost. Cloud infrastructure, tooling licences and third-party services (such as SIM farms or premium threat feeds) are billed at cost, and only where the engagement genuinely requires them. Retesting is included, not billed.
What are the common questions about this?
How much does a penetration test cost?
A single web application penetration test typically lands between Rs 45,000 and Rs 1,20,000, mobile and API work sits higher, and retainers run from Rs 35,000 per month. Every quote is confirmed in writing before work starts.
What is always included?
The scoping call, the written rules-of-engagement document, the technical report, the one-page executive summary, the evidence pack, remediation support while the fixes are in flight, and the retest after remediation.
What is charged separately?
Travel and accommodation for on-site work outside Kochi, third-party tool and infrastructure licences, and out-of-hours emergency response beyond what the retainer covers. All of these are agreed in advance, not invoiced afterwards.
Do you offer a free consultation?
Yes. Every prospective client gets a free 30-minute scoping call, and early-stage startups get that call extended into a free initial exposure review.
Get a fixed quote
Send the scope and the deadline. You will get a price band and a start date, with the reasoning shown.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.