Work out what your test should take

The largest single multiplier in application testing. Every authorisation boundary has to be tested in both directions, so each new role costs more than the one before it.

Count the things that do something different. A hundred pages rendering the same three templates is a small application. Twelve pages with a workflow engine behind them is a large one.

Unauthenticated-only testing is materially cheaper and materially less useful. Most of what matters is behind the login.

Cuts discovery time and raises finding quality. Usually reduces total cost for anything above trivial size.

Both platforms is not double, because the backend is shared and most of the interesting work is against it.

The largest single multiplier in application testing. Every authorisation boundary has to be tested in both directions, so each new role costs more than the one before it.

Cuts discovery time and raises finding quality. Usually reduces total cost for anything above trivial size.

Fifty identical instances behind a load balancer is one host worth of work. Fifty different appliances is fifty.

The band assumes one, from an assumed-breach starting position.

An undocumented API costs discovery time before any testing starts.

Endpoint count matters less than the number of distinct authorisation models across them.

The band assumes one, reviewed against a recognised benchmark.

Targeted at security-relevant components, not the whole tree. This is the widest band we publish.

A red team is bought to test detection and response against a goal, not to enumerate vulnerabilities.

Production testing needs care, out-of-hours windows and rollback planning. Staging that does not match production produces findings you cannot act on.

Restricting testing to nights or weekends adds effort and usually a premium. Compressing a ten-day scope into four calendar days does not reduce the days.

One retest inside a defined window should be in the base price. A firm charging separately for the first retest is quoting a report, not a remediation cycle.