Security spending goes wrong in a predictable way: a business buys a penetration test because a client asked for one, receives forty pages of findings, and has no budget left to fix any of them. The test was not the problem. The order was.
The table, by activity
| Activity | Cost | What you get |
|---|---|---|
| Website hardening, single site | from Rs 7,999 | Patching, access control, backup verification |
| Vulnerability assessment | Rs 40,000 - Rs 1,20,000 | A scan with a ranked list of what is open |
| Framework gap assessment | Rs 60,000 - Rs 1,50,000 | Position against a known standard |
| Security audit | Rs 75,000 - Rs 3,00,000 | Whether process and controls hold up |
| Application penetration test | Rs 80,000 - Rs 3,00,000 | Someone trying to break in, and how |
| Network and infrastructure test, with retest | Rs 2,00,000 - Rs 8,00,000 | What an attacker sees from outside and inside |
| Monitoring retainer and evidence | Rs 8,00,000 - Rs 35,00,000 | A year of watching and proving |
The order that protects the most
Hardening first. It is the cheapest line in the table and it closes the issues that a scan would find anyway: unpatched software, weak access control, an untested backup, a certificate nobody renews.
Then testing, once the basics are closed. A penetration test is a measurement, not a repair. Measuring a system that has not been hardened tells you what you already suspected.
Then monitoring, only if the business has something worth watching continuously. A small brochure site does not; a payments workflow does.
Why a test without a fix budget is theatre
A penetration test finds and proves. It does not patch, and it is not meant to.
The failure mode is a report that goes into a folder because nobody scoped the remediation. Six months later the same findings appear in the retest, and the second report costs the same as the first.
Either budget the fix alongside the test, or buy the hardening first and test after it. Doing the test and stopping is the most expensive way to buy reassurance.
Small business, realistic budget
For a business with a website, an office network and no in-house security person, the honest sequence is:
- Website hardening, from Rs 7,999.
- A vulnerability assessment, Rs 40,000 to Rs 1,20,000.
- Fix what it finds, which is usually a smaller number than expected.
- Repeat annually.
That is a defensible programme at under a lakh in year one. A penetration test belongs in year two, once the basics are clean and a client requires evidence.
What the expensive end buys
Above Rs 8,00,000 a year, you are buying continuous operation rather than an annual event: log collection, alerting, tuning, evidence retention and someone accountable when an alert fires at 2am.
That is justified by regulation, by contract, or by an incident that has already happened. It is not justified by anxiety alone, and vendors who sell it on anxiety are selling a subscription, not a posture.
Incident response, priced before you need it
A retainer for emergencies is a strange purchase, because the value is zero in the years nothing happens. It is still worth pricing in advance, for one reason: the alternative is negotiating a fee at three in the morning with a provider who knows you have no options.
Ask any security partner what an incident costs before you buy anything else. A ransomware containment, a credential leak, a payment page serving injected code — each has a rate, and the rate is not the hourly figure on the website.
A business that knows the number can decide whether to self-insure. A business that does not know it is buying whatever is offered on the worst day of its year.
The question that changes the quote
Ask any provider what they will not do. A test without a scope exclusion list is a test that will find the same generic issues on every target, and generic findings are the easiest to sell and the hardest to act on.
Then ask for the retest price before signing. A test whose retest is not priced is a test designed to be repeated at full cost.
FAQ
Is a vulnerability scan the same as a penetration test? No. A scan compares versions and configurations against known issues. A test uses judgement to chain weaknesses into an actual route in.
How often should a website be tested? Annually is the common baseline, and after any major change to authentication, payments or data handling.
Do we need testing if we use a hosted platform? Your responsibility is usually the configuration and the content, not the platform. Hardening and a configuration review cover most of it.
Can compliance replace security? No. Certification proves a process exists; it does not prove the system resists. Plenty of certified organisations have been breached.
What does an incident response cost? It is priced by urgency and scope, not by the hour, and it is always more expensive than the work that would have prevented it.
Security work in Noida
We start security engagements from Noida with hardening, because it is the part that changes the outcome. Call 7840002466 or describe the systems through the contact page.
For certification rather than testing, see the compliance cost comparison.
