Once
One-off penetration test
A focused test of the systems you choose, ahead of a launch, an audit or a major change.
What it includes
- Human-led, AI-assisted testing
- Proof and a fix per finding
- Report, briefing and one retest
Priced on your scope, never from a list.
Every test is quoted after a scoping conversation. The price follows the systems you run and the depth of testing they need. What you receive stays the same.
Two ways to buy a test.
One test of the systems you choose, or a full test every quarter. Both are quoted on their scope.
Every quarter
Continuous testing
A full test every quarter, with checks between rounds on request as you ship.
Each round includes
- Human-led, AI-assisted testing
- Proof and a fix per finding
- Its own report and briefing
Six things set the price.
Each one is agreed with you before the quote.
Applications and APIs
Each app, API or cloud account in scope adds its own attack surface.
Sample answer- app.acme-corp.com
- api.acme-corp.com
Environment and windows
We test live systems by default, inside windows you agree. Narrow windows spread the same testing over more days.
Sample answer- live
- weeknights
User roles
We sign in as each role, so every role adds authorisation paths to check.
Sample answer- customer
- support
- admin
Integrations
Single sign-on, webhooks and partner APIs add flows to test where they meet your systems.
Sample answer- single sign-on
- webhooks
Depth of testing
Business logic such as payments, approvals and refunds is worked by hand, step by step.
Sample answer- /checkout
- /refunds
How often you test
One test, or a full test every quarter with continuous penetration testing.
Sample answer- once
What a useful brief contains.
A useful brief names what you run, who uses it and what we must leave alone. A few lines are enough, and we fill the gaps with you.
Please test our web app and its API:
app.acme-corp.comandapi.acme-corp.com.What you runApps, APIs or hosts, even roughly.
Customers, support staff and admins all sign in.
Who uses itThe kinds of user we should test as.
Please leave the payment provider alone.
What to leave aloneAnything we must not touch.
A new checkout goes live next quarter, and we want it tested first.
When, and whyA launch, an audit or a customer asking.
Sketch the size of your test.
Three questions. Your answers carry into the quote form.
Your quote request
Answer the three questions and the test you describe is drawn here.
Quotes, scope and what is included.
Anything else can go in the quote form. For the method, read how a GreySurface test runs.
Do you publish prices?
No. Each test is quoted on its scope after a scoping conversation, because two tests of the same kind can differ widely in size.
How quickly do you reply to a quote request?
Within one business day. We then agree the scope with you and send the quote.
What does the price include?
Every test includes proof of exploit and a fix for each finding, and an executive briefing for your leadership. It also includes one retest of the findings we reported, within 30 days of the report.
What do you need from us for a quote?
A rough outline is enough to start: what you run, who uses it and what to leave alone. The scoping conversation fills the gaps, then the quote follows.