For a Basic Pentest, we have a set of guidelines we follow and check for mostly all low-hanging and mid-tier bugs. Along with a report of the same and mitigation strategies.

Depending upon the scope of the applications and the pentest type a typical pentest could last from anywhere about 10 days to 2 months. Also upon the scoping patterns and targets, this number can vary.

Typically a Threat model is done before a pentest to assess its scopes and the architecture of the application. A Threat model can also be a separate entity in case the building of new features is yet to be developed or still in the planning phase.

As every application has a different scope and different complexities the price determinations are usually done after scoping the target for a custom and manual pentest, on the other hand, we do provide provisionality to start a pentest on an ad-hoc method where the price of bugs are fixed based on severity type.

First, the number of bugs doesn't determine if an application is secure or not, so even finding 100+ bugs on applications can sometimes be of no use as a kill-chain could still exist, whereas sometimes just finding better quality bugs can lead to reduced cyber attacks as it fixes the underlying problem itself.

We understand what every business is looking for while hiring outside help and pride ourselves on it the 3 key factors being

1. Speed

2. Best Quality

3. Competitive Pricing

We do not compromise on these 3 factors no matter which type of pentest is being performed.