How does AI change the cost of a penetration test in India?
Key takeaways
- A penetration test in India costs Rs 40,000 to Rs 12,00,000 excluding 18% GST, and the AI-assisted variant does not fall below the bottom of that band.
- The underlying commercial rate is roughly Rs 12,000 to Rs 30,000 per tester-day, so a saving shows up as fewer tester-days, not as a discounted day rate.
- An API test covering 50 to 150 endpoints is priced at Rs 1,00,000 to Rs 4,00,000, and this is where AI enumeration saves the most.
- CERT-In's 6-hour incident reporting window under Directions 20(3)/2022-CERT-In raises the value of testing before a release, not of testing after it.
- A quote that itemises tester-days, endpoint count and retest terms is checking the rate; a quote that only gives a lump sum is not.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Where does AI actually reduce the cost?
In three places, and only three. First, enumeration. Discovering hosts, subdomains, directories, exposed repositories and API endpoints is monotonous, wide and perfectly suited to a machine, and it is exactly the work that consumes the first two days of a manual engagement. Second, triage. A raw scan can return a thousand results, and reducing that to the twenty that are real is a machine-classification job, though a human still signs off. Third, payload adaptation, where stack-aware test strings remove the false negatives that make a scanner look clean. Everything after that is unchanged. A tester still needs days to chain an access-control weakness into a data exposure, and that chain of reasoning is the part a client is actually buying.
Why does the rate card in India not drop for AI-assisted work?
Because the price is labour plus tooling, and the tooling has a floor. A commercial scanner subscription, a fuzzing platform and the engineer time to configure, supervise and interpret them all cost money, and in India the day rate of Rs 12,000 to Rs 30,000 per tester-day is what a client is really paying for when a signed report carries legal and commercial weight. Cutting the day rate because a tool exists would mean the human who signs the report is cheaper, and that is the wrong trade. What should fall is the number of days. In a 10-day manual engagement, AI-assisted enumeration typically returns one to three days of that budget to the client, or lets the same budget buy a broader scope.
What should a good AI-assisted quote itemise?
Six lines, and if any of them is missing, ask for it. The tester-day count and the rate applied. The endpoint or host count in scope, because a price with no count has no ceiling. The number of roles and authenticated workflows tested, since unauthenticated coverage is half the product. The tooling the fee covers, and whether there is a separate platform charge. The retest policy, typically one free verification pass within 30 days of the report. And the report format, with CVSS scoring and step-by-step reproduction. A quote that gives you a single number and a promise of AI speed is selling a scanner, and you will pay again for the actual testing.
Does AI change the price of a compliance-driven test?
Less than you would expect, because the compliance driver is the evidence, not the coverage. CERT-In and DPDP obligations reward documentation: a six-hour reporting capability under Directions 20(3)/2022-CERT-In, and a breach intimation regime under DPDP Rule 7 that commences in May 2027 with details due to the Board within 72 hours. Those requirements are met by a readable report, a retest and an incident runbook, and none of those are produced faster by a model. AI-assisted testing still helps the evidence, because a broader sweep finds the gaps the runbook must cover, but the price is driven by the report and the rehearsal, not by the scan.
| Engagement type | Price band (excl. 18% GST) | Where AI changes the price |
|---|---|---|
| Static website | Rs 40,000 - 90,000 | Minimal; the target is small and a human proves every finding |
| Web application | Rs 1,20,000 - 3,50,000 | Moderate; authenticated workflow mapping is automated |
| Mobile app (per platform) | Rs 1,00,000 - 3,00,000 | Moderate; binary analysis and API discovery are automated |
| API, 50-150 endpoints | Rs 1,00,000 - 4,00,000 | Largest saving; enumeration and schema mapping are machine work |
| Internal network and AD | Rs 1,50,000 - 6,00,000 | Small; exploitation chains are human reasoning |
What are the frequently asked questions?
Get a straight answer on this
Send us the endpoint count or host list, and we will return an itemised quote with tester-days, rate and retest terms on it.
Send us the details See pricing