How much does it cost to hire a certified ethical hacker in India?
Key takeaways
- A single web application penetration test in India typically costs Rs 45,000 to Rs 1,20,000 before GST, and full estate assessments run from Rs 1,50,000 to Rs 8,00,000.
- The honest unit is the tester-day at roughly Rs 12,000 to Rs 30,000, because scope, depth and the number of distinct roles drive the total.
- There is no statutory certification called a certified ethical hacker in India as of 2026, so a certificate offered as the main credential is a marketing artefact, not evidence of skill.
- GST at 18% applies to security testing services, so a quote of Rs 1,00,000 becomes Rs 1,18,000 on the invoice.
- Phishing simulation campaigns for Indian organisations are typically priced at Rs 25,000 to Rs 1,50,000, and red team assessments from Rs 1,50,000 to Rs 6,00,000.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does a certified ethical hacker actually cost per engagement?
The bands below are what Indian engagements actually sell at, and they are wide because scope is wide. A single web application penetration test: Rs 45,000 to Rs 1,20,000. A mobile application test: Rs 35,000 to Rs 90,000. An API test with authentication and business-logic abuse: Rs 50,000 to Rs 1,50,000. A full external and internal network assessment with a retest: Rs 1,50,000 to Rs 4,00,000. A red team assessment with an adversary simulation: Rs 1,50,000 to Rs 6,00,000. A phishing simulation campaign across 100 to 500 employees: Rs 25,000 to Rs 1,50,000. A bug bounty programme setup, including policy, scope and triage process: Rs 1,00,000 to Rs 5,00,000. All of these are before GST at 18%.
Is there such a thing as a certified ethical hacker in India?
Not in the statutory sense. There is no Indian certification body that licenses a profession called ethical hacker, and no certificate makes someone safe to hire. What exists is a stack of vendor-neutral qualifications such as CEH, OSCP, CISSP, eJPT and the ISEC certifications, plus CERT-In empanelment for audit agencies, which is a mark on the organisation rather than the individual. Treat all of these as screening signals, not as capability. A certificate plus no sample report, no methodology and no named tester tells you nothing. Ask who will actually be on your engagement, what they have broken before, and what their retest policy is, because that is the whole decision.
Why is the tester-day rate the number that matters?
Because every other number is derived from it. Scope, depth, the number of distinct user roles, the number of environments and the number of retest cycles all convert into days. A tester-day at Rs 12,000 to Rs 30,000 is the honest base rate, and a quote that looks cheap is usually a quote that has assumed fewer days than the work needs. Ask the vendor to break the estimate into days, and check whether the retest is inside the number. A retest billed as a fresh engagement is where a cheap quote quietly becomes an expensive one once findings arrive, and the retest is exactly the part you should not cut.
What should a fixed-price proposal contain in India?
Six items. The named systems and environments in scope, with the roles and APIs included. The number of tester-days and how many are hands-on. The methodology by name, so the work is comparable across vendors. The deliverable list, including the retest and any remediation support. The total price, with 18% GST shown as a separate line, and payment milestones. And the rules-of-engagement document that both sides sign. If a proposal is missing the day count or the GST line, it is not comparable with one that has them, and you will be comparing a scope with a price instead of a test with a test.
| Engagement | Typical price band | What drives the price |
|---|---|---|
| Single web application penetration test | Rs 45,000 - Rs 1,20,000 | Number of roles, APIs, depth and retest cycles |
| Mobile application test | Rs 35,000 - Rs 90,000 | Platforms, native components and backend API coverage |
| External and internal network assessment | Rs 1,50,000 - Rs 4,00,000 | Number of hosts, segments and credentialed depth |
| Red team assessment | Rs 1,50,000 - Rs 6,00,000 | Objectives, rules of engagement and detection coverage |
| Phishing simulation, 100-500 employees | Rs 25,000 - Rs 1,50,000 | Campaign count, landing pages and training inclusion |
| Bug bounty programme setup | Rs 1,00,000 - Rs 5,00,000 | Scope breadth, platform, triage and policy design |
What are the frequently asked questions?
Get a straight answer on this
Send us your application list and the number of distinct user roles, and we will return a fixed-price proposal with the day count and the GST line shown separately.
Send us the details See pricing