How much does a penetration test cost in India?
Key takeaways
- A static website penetration test in India costs Rs 40,000-90,000 excluding GST, according to AAVETech's 2026 rate card.
- A web application test ranges from Rs 1,20,000 to Rs 3,50,000, with price driven by authenticated depth and the number of roles tested.
- Indian VAPT is priced at roughly Rs 12,000-30,000 per tester-day, plus 18% GST, so a quote implying materially less is missing scope.
- Internal network and Active Directory testing is the most expensive entry, at Rs 1,50,000 to Rs 6,00,000.
- GST is charged at 18% on professional services and should be quoted as a separate line, not folded into the headline figure.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What drives the price up or down?
Price tracks complexity, not size. A static marketing site with no login is a single tester-day of work. A web application with twenty user roles, mobile clients, payment integrations and an internal API is a multi-week engagement, and each additional role multiplies the authentication effort because every role must be tested against every object it should not reach. The single biggest price lever is whether the test is unauthenticated or authenticated across all roles. A second lever is the number of environments. A third is whether remediation support and retest are included, because a retest is a genuine second pass over the same ground, not a courtesy.
Should the quote include GST?
Yes, and it should be a separate line. Professional security testing in India attracts 18% GST, and a quote that omits it will be roughly a sixth cheaper than the real invoice. Ask for the breakdown so you can compare like with like across vendors. A legitimate proposal separates the pre-tax testing fee, the GST line and any third-party costs such as tool licences, infrastructure or travel. If a vendor quotes a round number with no tax line and no scope document, that is the first warning sign that the number was guessed rather than derived from a scoping conversation.
What are the red flags in a cheap penetration testing quote?
Six red flags. A price arriving by return email with no questions about roles, endpoints or hosts. A complete web application assessed and reported within 48 hours. No named methodology, no sample report, and no answer on manual effort. A sample report full of tool output and plugin numbers with no steps a developer could follow. A CERT-In empanelment claim you cannot find on CERT-In's published list. And no retest, or a retest billed as a fresh engagement. Each of these appears in isolation often enough; together they describe a scan, not a test.
How do I get a fixed-price proposal?
Send the scope in writing before asking for a price: how many applications, how many user roles, which environments, whether there is an API and a mobile client, and what the deadline is. A vendor who quotes from that will give you a fixed price and a delivery date. A vendor who asks for a budget first and works down to it is not scoping, and you will get a thin engagement with a large invoice. We publish our own bands on the pricing page for exactly this reason, so you can sanity-check an offer before you send an email.
| Engagement type | Indicative range (ex-GST) | Typical timeline |
|---|---|---|
| Static website penetration test | Rs 40,000 - 90,000 | 3-5 working days |
| Web application penetration test | Rs 1,20,000 - 3,50,000 | 7-12 working days |
| Mobile app security test (per platform) | Rs 1,00,000 - 3,00,000 | 7-10 working days |
| API penetration test (50-150 endpoints) | Rs 1,00,000 - 4,00,000 | 8-15 working days |
| External network penetration test | Rs 60,000 - 2,00,000 | 5-8 working days |
| Internal network and Active Directory test | Rs 1,50,000 - 6,00,000 | 10-20 working days |
| Cloud configuration security review | Rs 1,00,000 - 3,50,000 | 5-10 working days |
What are the frequently asked questions?
Get a straight answer on this
Send us the number of applications, the number of user roles and your deadline, and you will get a fixed price and a start date within one working day.
Send us the details See pricing