AI pentest pricing: what changes the quote
AI pentest pricing: we quote after scoping, with no price list. Six factors change the quote: apps, roles, API size, environments, deadline and retests.
Short answer
Excession Labs quotes prices after scoping. We publish no price list. The quote depends on the number of apps, the number of roles, the size of the API, the environments in scope, your deadline and your retest needs. A free pentest pilot with a small written scope is available, with limited places.
We quote after scoping and publish no price list. The quote depends on six things you can describe up front, so prepare them for the scoping call.
What changes the quote?#
Six factors change the amount of testing work, and you know each one before the call.
| Factor | Why it changes the quote | What to prepare |
|---|---|---|
| Number of apps | Each app has its own routes, logic and sign-in flow. | A list of apps and URLs |
| Number of roles | Each role adds a set of differential checks. | A role list and a test account per role |
| API size | More endpoints and objects mean more authorization checks. | An OpenAPI spec or a route list |
| Environments | Staging, production and multiple tenants each need setup and care. | Which environment to test, and its limits |
| Deadline | A tight date narrows what we can schedule. | A date, and the reason for it |
| Retest needs | Retests add work after your fixes. | Whether you want one, and for which findings |
Other things matter less but still count: bounded tests with a cost (uploads, email sending, paid third-party APIs), a need for CVSS vectors, and special report requirements.
How do you get a price?#
- Tell us about the apps, API and goal. Use the contact page or the pilot form.
- Join a short call. We ask about the six factors above.
- Receive a written scope and proposal. The price is in the proposal.
- The system owner authorizes the scope in writing.
- Testing starts.
How it works covers the steps after that. If you test after each meaningful release, per-release testing explains how a scope delta keeps later tests smaller.
What is the free pilot?#
The pilot is a small, written-scope test. The system owner gives written authorization before testing. You receive every finding in the agreed scope with evidence and fix guidance, and the results have no paywall. Places are limited and we review each request by hand. We do not publish capacity, turnaround times or dates.
You can apply on the pilot page. The pilot shows you the report structure and evidence standard before you scope a larger job.
What kinds of paid work exist?#
We offer two kinds:
- One-off tests for a specific need, such as a launch, a customer security review or a new API.
- Recurring testing after releases, scoped as deltas. See per-release testing.
Prices for both are quoted after scoping.
Why not publish a price?#
A single-role marketing site and a multi-tenant app with five roles and a large API are different jobs. A published number would be wrong for most buyers.
What should you compare when you get quotes?#
Compare scope, not totals. Ask each provider:
- Which roles and environments are included?
- Is a retest included, and for which findings?
- What evidence does each finding carry?
- Who checks the evidence and writes the report?
- What are the stated limits and bounded tests?
Our answers are on the AI vs manual pentesting and safety pages. For a provider comparison, see pentestcompare.com.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.
Questions
Do you publish prices?
No. Prices are quoted after scoping, because the same app name can mean very different work. We would rather give a price for a written scope than a guess for a vague one.
Is there a free option?
Yes, a free pentest pilot with a small written scope. Places are limited and reviewed by hand. You receive every finding in the agreed scope with evidence and fix guidance, with no paywall on the results.
Is the retest part of the price?
We can retest fixed findings. Whether a retest is included in a quote is agreed during scoping. Say that you want one when you describe the need.
How long until I get a quote?
We do not state timings. The first step is a short call to understand the need, then a written scope and proposal.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.