Penetration testing cost in India in 2026 spans a wider range than almost any other line item in a software budget: a startup can pay under Rs 50,000 for an automated scan with a report stapled on, or Rs 3-15 lakh for a manual, methodology-driven VAPT engagement that an auditor will actually accept. Most of that gap has nothing to do with how risky your application is and everything to do with what you are actually buying. Here is what the number is made of, and how to tell a real quote from a repackaged scanner output.
The Three Price Bands You'll Actually See
Vendor quotes in India tend to cluster into three bands, and knowing which one you're looking at matters more than the number itself.
At the bottom, roughly Rs 50,000 to Rs 1 lakh buys an automated scan: a tool like Burp Suite or Nessus runs against your app, someone skims the output, and you get a PDF. It catches missing headers, outdated libraries and obvious misconfigurations. It will not catch a broken authorization check that lets User A fetch User B's invoices, because that requires a person actually trying it.
In the middle, Rs 1 lakh to Rs 3 lakh is where real manual testing starts: a tester works through the OWASP Top 10 by hand, checks business logic specific to your app, and the report ties each finding to actual exploitation steps rather than a CVE ID. This is the band that satisfies most SOC 2, ISO 27001 and client-security-questionnaire requirements.
At the top, Rs 3 lakh to Rs 15 lakh-plus covers enterprise and empanelled engagements: multiple testers, senior review, broader scope (web, API, mobile, cloud config, sometimes a red-team component), and formal retest cycles built into the contract rather than billed later. Internationally the same tiering holds in dollar terms, with full-scope web application testing commonly priced at $15,000 to $35,000 once you add authenticated roles, API coverage and business-logic testing on top of a basic scan.
What Actually Moves the Price
Four things drive penetration testing cost more than anything else, and none of them is "how big is your company."
Scope size. The number of user roles, API endpoints and third-party integrations (OAuth, payment gateways, SMS/WhatsApp providers) is usually the single biggest cost driver, because each role and endpoint is a separate set of test cases a human has to run through, not just a bigger number on an invoice.
Testing depth. Black-box testing, where the tester gets zero internal access and has to map your app from scratch, costs more than grey-box testing, where you hand over test accounts and basic documentation up front. For most startups, grey-box is the better trade: you're not trying to simulate a nation-state attacker, you're trying to find the bugs your own team missed.
Compliance target. A pentest done to satisfy a vague internal "let's be safe" goal and one done to pass a specific SOC 2 Type II audit are different products, even against the same app, because the auditor-facing report needs specific evidence formats and coverage statements the cheap version skips.
Retest inclusion. Whether the quote includes a free retest after you fix the findings. This is the detail that separates a real engagement from a lead-gen exercise, and it's the one line startups forget to ask about until the invoice for round two shows up in month three.
The Rs 25,000 Red Flag
If a quote for a full web application comes in under roughly Rs 25,000-40,000, it is almost certainly an automated scan with a new cover page, not a manual test. That's not necessarily a scam - a scan has its place as a cheap first pass - but it should not be the thing you hand to an enterprise client's security team or an auditor and call it a penetration test.
What Most Quotes Leave Out
The headline number rarely includes everything you'll actually pay for. Remediation support (someone explaining to your engineers exactly how to fix a finding, not just that it exists) is usually a separate line, if it's offered at all. Retest rounds beyond the first one are often billed again from scratch. And if a finding turns out to be severe enough to delay a client contract or a compliance deadline, the cost of that delay dwarfs the pentest fee itself; this is the category where a managed security and run-support partner earns its retainer, because the fix needs to ship the same week the finding lands, not queued behind the next sprint.
A second cost that rarely appears in the quote: the gap between "we ran a pentest" and "we closed the loop." A report with 14 findings and no tracked remediation is a liability disclosure document, not a security improvement. Budget time, not just money, for someone to actually triage and close each item.
How to Buy This Without Overpaying or Underbuying
Match the tier to what you're actually trying to prove. If you're a pre-revenue startup with no compliance deadline, a mid-tier manual test (Rs 1-3 lakh) on your core authentication and payment flows covers the realistic risk without paying for an enterprise scope you don't need yet. If you have a SOC 2 audit or an enterprise client's security questionnaire on the calendar, go straight to a methodology-driven engagement and confirm up front that the report format matches what the auditor expects, since asking after the test is done is too late.
Ask three questions before signing any quote: is this manual or automated, is a retest included, and what happens if a finding is critical enough that you need help fixing it same-week rather than next-sprint. Vendors who answer all three clearly, with specifics rather than reassurance, are usually the ones whose Rs 1.5 lakh quote and Rs 1.5 lakh quote from a scanner-only shop are not actually the same product, even though the invoice looks identical.