NexusSec.Most VAPT providers do not publish prices, which makes budgeting hard and comparing quotes harder. We do. Below is what we charge, what moves the number up or down, and how to compare quotes so that you are comparing the same work.
NexusSec VAPT prices
VAPT at NexusSec starts from ₹30,000. The final price depends on what is tested, so a business with more sites, more devices, web applications or APIs pays more than a single small office. We agree the price on a 30-minute scoping call and confirm it in writing before any work starts. After that it does not change, and there is no hourly billing.
Every price includes a written report, a remediation call and one free retest. For a single-site business, testing takes about five working days, mostly remotely, and the report and walkthrough call follow within ten working days of the start. The retest happens whenever you are ready.
What moves the price
- Sites and devices. Each extra office, plant or warehouse adds networks, a firewall and devices to test.
- Web applications. A customer portal or internal web application is tested page by page and role by role, which takes longer than a network test. The number of user roles matters more than the number of pages.
- APIs. Each API is tested for broken authorisation and data exposure, so the number of endpoints and roles drives the effort.
- Internal, external or both. An external test looks at what the internet can reach. An internal test assumes an attacker, or a compromised laptop, is already inside. Most businesses need both.
- Work on site. Most testing runs remotely. Anything that needs a tester on site, such as wireless testing, is agreed in advance and adds time.
- Report format. If a customer, auditor or insurer needs the findings in a particular format, say so during scoping so it is in the quote.
Why the cheapest quotes are often scans
A vulnerability scan is automated: software checks your systems against a list of known issues and produces a long report. It is useful and cheap, but it is not a penetration test. A penetration test adds a person who confirms which findings are real, removes false positives and tries to chain small weaknesses into real access, which is how attacks actually happen. If one quote is far below the others for the same scope, ask how much of the work is manual. Our guide to VAPT vs vulnerability scanning explains the difference in more detail.
How to compare VAPT quotes
Ask every provider the same questions, in writing:
- Exactly what is in scope: which IP addresses, sites, applications and user roles.
- How much of the testing is manual, and who does it.
- Whether a retest after you fix the findings is included, and how many.
- What the report contains. Ask for a sample with client details removed.
- Whether the price is fixed, or what would make it change.
- How your data and the report are handled once the work is done.
More questions, and the red flags to watch for, are in our guide to choosing a VAPT company.
What to prepare for an accurate quote
- The number of sites, and roughly how many servers, workstations and network devices each one has.
- Your public IP addresses or domain names, if you know them.
- Any web applications or APIs you want tested, and how many user roles each one has.
- What is prompting the test: a customer questionnaire, an audit, an insurance renewal or your own concern.
- Any deadline, and any format the report has to follow.
How often to budget for it
Plan for at least one VAPT a year, and another after a major change such as a new office, a firewall replacement, a cloud migration or a new customer-facing application. If you store, process or transmit card data, PCI DSS requires penetration testing at least once every 12 months and after significant changes.
