Your annual audit is approaching, the board wants a cybersecurity budget, and three VAPT proposals arrive with very different totals. One is priced per IP address. Another includes an internal network assessment. A third bundles applications, cloud infrastructure and retesting. Which one is fairly priced?
Corporate penetration testing in India is best budgeted against a defined scope. A company’s employee count or total IP allocation cannot, by itself, establish the cost. The important questions are which systems will be tested, what the testers will investigate and what evidence your organisation will receive.
This guide explains how to build a defensible budget, compare proposals and request an exact quote. The rupee calculations below are illustrative procurement examples, not verified Indian market rates or published Rex prices. A reliable price for your infrastructure requires a written scope and proposal.
In this article
1. Why corporate pentest quotes differ
2. An illustrative pricing breakdown in rupees
3. Why infrastructure size does not tell the whole story
4. What should be included in the assessment fee
5. How to compare proposals without buying less coverage
6. How to reduce cost without weakening the assessment
7. Frequently asked questions
8. Request a scoped proposal from Rex
1. Why corporate pentest quotes differ
VAPT stands for vulnerability assessment and penetration testing. Vulnerability assessment identifies potential weaknesses. Penetration testing investigates relevant weaknesses under agreed conditions to establish their practical impact. A proposal should explain how both activities contribute to the result.
An automated assessment of a small internet-facing environment and a manual internal assessment across several business units are different purchases. Shared labels such as pen testing, pen test or penetration assessment do not make them equivalent. Less precise terms such as intrusion testing, penetration hacking and pentest testing should prompt you to ask for the actual method and deliverables.
For procurement, define the question the assessment must answer. Are you checking external exposure, investigating whether a compromised employee account could reach sensitive systems, or validating separation between business networks? Different objectives require different access, expertise and effort.
Price drivers to clarify before requesting quotations. None establishes a market rate on its own.
Start with the network coverage your business needs: Explore Rex’s network vulnerability assessment and penetration testing service
2. An illustrative pricing breakdown in rupees
A transparent way to review a quote is to separate effort from additional charges. Ask for an explanation of the allocation to preparation, testing, reporting and retesting, even where the supplier sells a fixed-price engagement rather than individual days.
For the following worked example only, assume a blended professional fee of ₹15,000 per person-day. This is an arbitrary calculation input, not a recommended rate, a market average or a Rex quotation. The effort assumptions are also illustrative and do not prescribe how long your network should take to test.
Worked example of a ₹2.10 lakh assessment fee
At the same hypothetical rate, six person-days would cost ₹90,000 and twenty-eight would cost ₹4,20,000. These totals demonstrate the effect of effort; they are not price bands for small, medium or large enterprises. Fourteen person-days also does not necessarily mean fourteen elapsed working days: staffing, access and review schedules affect the calendar.
Confirm whether applicable taxes, travel, on-site work and specialist activities are included. Keep your internal remediation budget separate. The cost of replacing an unsupported system or changing a network design is not automatically part of the assessment fee.
Use the provider’s actual commercial terms to replace the assumptions in your budget.
3. Why infrastructure size does not tell the whole story
A count of 200 IP addresses could describe largely similar workstations, a diverse server estate or mostly unused address space. Those situations do not create the same workload. Ask whether pricing uses allocated addresses, live hosts, reachable services or an agreed inventory.
External and internal network coverage
External testing examines agreed internet-facing assets. Internal testing starts from an agreed internal position and can examine additional relationships between systems. State whether VPN access, identity infrastructure, privileged access paths and network segmentation are included. Do not infer internal coverage from an external IP list.
Sites and sensitive environments
Several locations may require additional coordination, on-site access or separate test positions. Restricted maintenance windows can affect scheduling. Operational technology and other sensitive environments may need specialist methods and operational constraints; identify these before the provider estimates the work.
Applications and cloud services
A network assessment does not automatically include the business logic of a customer portal or the permissions in a cloud account. Scope those services explicitly. Shared infrastructure can create opportunities to coordinate work, but it does not remove the need to test distinct security controls.
For cloud-specific coverage, Review Rex’s cloud penetration testing service
For business applications and portals, Review Rex’s web application penetration testing service
4. What should be included in the assessment fee
Agree the outputs before signing. The following is a practical procurement checklist to adapt to your environment and assurance requirements.
1. Defined scope — asset inventory, test positions, environments, permitted activities and explicit exclusions.
2. Testing method — automated assessment, manual validation and the depth of authenticated testing where agreed.
3. Operational arrangements — testing windows, escalation contacts, handling of sensitive evidence and stop conditions.
4. Technical report — validated findings, affected assets, evidence, severity rationale and actionable remediation guidance.
5. Management summary — business impact, priorities, material limitations and unresolved risks.
6. Closure terms — retest window, included rounds, eligibility for retesting and how closure status is documented.
CERT-In’s comprehensive cybersecurity audit guidelines and NIST’s technical assessment guide provide authoritative context for planning assessments and using their findings. Neither reference supplies the illustrative prices in this article. Use the relevant framework to discuss coverage, rather than treating its name on a proposal as proof that all needed work is included.
5. How to compare proposals without buying less coverage
Send every shortlisted provider the same scope brief. Ask each to identify assumptions, exclusions, manual testing coverage, access dependencies, reporting commitments and retest terms. Compare the payable total after necessary additions, not only the headline fee.
A consistent brief helps procurement compare coverage and commercial terms together.
Consider two fictional offers. Supplier A quotes ₹1.20 lakh for external testing and reporting. Supplier B quotes ₹1.80 lakh for external and internal testing, an identity review and one retest. The difference is not automatically a premium for the same service. Ask Supplier A to price the missing work, or remove that work from Supplier B’s comparison if it is genuinely outside your requirement.
Request a redacted sample report and ask who will perform and review the assessment. Look for relevant experience, clear technical reasoning and usable remediation advice. A higher price is not proof of better work; a lower price is not proof of poor work. The provider should be able to explain the relationship between the scope, effort and outputs.
Where your procurement or regulatory requirements specify a CERT-In-empanelled auditing organisation, verify current eligibility against the official information and make it a selection condition. A generic completion certificate should not be assumed to satisfy a specific audit requirement.
6. How to reduce cost without weakening the assessment
Start by removing uncertainty from the brief. Supply an accurate asset inventory, current architecture information, known exclusions and a technical contact. Resolve access and test account requirements before the scheduled assessment. Avoid paying for repeated discovery caused by incomplete information.
Prioritise using business risk and the purpose of the assessment. If a phased programme is appropriate, document what each phase covers and what remains outstanding. A limited first phase should be described as limited; it should not become a company-wide assurance claim.
Reserve engineering capacity for remediation. Agree how long retesting remains available and what happens if fixes arrive after that period. Ask for a change-control mechanism so that new assets or additional requests do not lead to unexpected invoices.
For recurring assessments, request an annual plan that distinguishes baseline testing, change-driven work and retesting. Compare the annual scope with your expected changes before deciding whether a recurring arrangement provides value.
7. Frequently asked questions
Q1. What is the actual market rate for corporate pentesting in India?
Answer: There is no verified market-rate dataset used in this article that standardises enterprise scope and testing depth. The calculations above are examples only. Obtain comparable written quotations for your actual inventory, objectives and deliverables before approving a budget.
Q2. Can we budget purely on the number of IP addresses?
Answer: Use IP counts as an input, alongside live assets, service diversity, sites, identity systems, access and testing objectives. Ask how the supplier counts assets and prices work such as segmentation or identity testing.
Q3. Does the assessment price include fixing vulnerabilities?
Answer: Do not assume it does. Testing and remediation guidance may be included while implementation remains with your IT team or another supplier. Confirm responsibility for fixes and budget separately for internal work and technology changes.
Q4. Should retesting be included?
Answer: Make it an explicit commercial requirement if you need evidence that fixes worked. Confirm the number of rounds, the time window, which findings can be retested and how partially resolved or unresolved issues will be reported.
Q5. Is an annual pentest enough?
Answer: Choose the programme around your requirements, risks and significant changes. An annual assessment captures the agreed environment during its testing period. Material changes may justify additional testing before the next scheduled cycle.
Q6. How do we get a precise quote from Rex?
Answer: Provide the asset types and counts, sites, external and internal coverage, identity systems, cloud or application dependencies, required deadline and reporting expectations. Rex can use the scoping discussion to prepare a proposal for the agreed work.
8. Request a scoped proposal from Rex
A defensible pentesting budget explains what the organisation is buying, which risks the work addresses and how the findings will be closed. That makes the proposal easier for finance to evaluate and gives the CISO a clearer basis for prioritisation.
Rex Cyber Solutions offers network VAPT covering asset mapping, technical testing, business-focused risk reporting, remediation guidance and post-fix validation. Discuss your environment and procurement requirements so that the proposal states the agreed coverage, deliverables and retest terms.
In your enquiry, include your approximate live asset count, locations, testing objectives and audit deadline. Ask for a tailored scope and commercial proposal. Share sensitive inventories and network details through an agreed secure channel.
Request a tailored corporate pentesting proposal
Discuss your assessment scope with the Rex team
Authoritative references
CERT-In — Comprehensive Cyber Security Audit Policy Guidelines
NIST — Technical Guide to Information Security Testing and Assessment
%20(1).png)
.png)
.png)
