What are the red flags in a cheap penetration testing quote?
Key takeaways
- A price sent with no questions about your roles, endpoints and hosts is a number chosen to win the work, not derived from your scope.
- A complete web application assessed and reported in 48 hours is not physically possible at professional depth.
- A sample report containing tool output and plugin counts, with no steps a developer could follow, is a scan sold as a test.
- Indian VAPT is priced at roughly Rs 12,000-30,000 per tester-day plus 18% GST, so a quote below that band is missing scope.
- No retest, or a retest billed as a fresh engagement, is where a cheap quote quietly becomes an expensive one later.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What are the six red flags, in order of severity?
One, a price arriving by return email with no questions about roles, endpoints or hosts. Two, a complete web application assessed and reported within 48 hours, which is not possible at professional depth. Three, no named methodology and no sample report, so you cannot judge what will be done. Four, a sample report full of tool output and plugin numbers with no steps a developer could follow. Five, a CERT-In empanelment claim you cannot find on CERT-In's published list. Six, no retest, or a retest billed as a fresh engagement. The first three predict a bad engagement. The last three predict a good engagement that becomes expensive later.
What does the arithmetic behind the true cost look like?
Indian VAPT is priced at roughly Rs 12,000 to Rs 30,000 per tester-day, plus 18% GST, and a competent web application test consumes five to ten tester-days. So a real application test should land somewhere between Rs 60,000 and Rs 3,50,000 before tax. A quote for the same scope at a fifth of that price is not a discount, it is a different engagement, and the difference is usually the parts you cannot see: authenticated testing across roles, manual analysis rather than scanner output, and the retest. A cheap quote also tends to exclude the 18% GST line, which makes it look roughly a sixth cheaper again. Comparing two quotes without aligning the tester-day count and the tax line is the most common way Indian buyers get this wrong.
What should a legitimate penetration test certificate include?
That word is used loosely, so check what you are actually buying. A meaningful deliverable is a technical report with reproducible steps, evidence and impact, a one-page executive summary for non-technical readers, a prioritised remediation plan with effort estimates, and a retest result listing every finding as fixed, partial or open. The scope and dates of the engagement should be stated, and the authorisation reference and rules-of-engagement document should be identifiable. If what you are being offered is a one-page letter that says the system was assessed, that is a marketing artefact with no technical content behind it, and it will not satisfy an enterprise customer's due diligence.
What should you ask instead of just asking for price?
Ask for the scope in writing before you ask for a price, and ask for the proposal to state the tester-day count, the number of roles tested, the number of environments, the methodology, the named deliverables, the delivery date, the retest terms, and the price with GST as a separate line. Then ask one question that separates vendors instantly: what happens to the price if you find a critical issue on day one? A serious vendor will describe the delivery of a critical finding within hours, a written interim note, and the retest. A vendor that quotes a fixed price regardless of outcome is selling a report, not a service. We work on fixed-price engagements with a retest included, and we will tell you at scoping whether the depth you need is affordable.
| Red flag | What it usually means | What to ask instead |
|---|---|---|
| Price by return email | No scoping was done | Scope document, then a fixed price |
| Application reported in 48 hours | A scanner run, not a test | Tester-day count and methodology |
| No named methodology | No repeatable process | Standards used, such as OWASP or PTES |
| Report full of tool output | Findings not manually validated | A redacted sample report |
| Unverifiable empanelment claim | Borrowed or invented credential | Entity name to check on CERT-In's list |
| No retest, or retest charged | Findings will not be closed | Whether the retest is included and scoped |
What are the frequently asked questions?
Get a straight answer on this
Send us the cheap quote you received and the scope behind it, and we will tell you what is missing and what a comparable fixed-price engagement would include.
Send us the details See pricing