prices
every range below is indicative. scope sets the number, and you see the number in writing first.
Pick by depth, not by budget. Recon tells you where you are exposed; an assessment takes one thing apart properly; an engagement keeps someone on your stack while you ship.
A time-boxed look at the surface you actually expose, by hand.
$3k-$7k per engagement
5 working days · 50% up front
One scoped application, binary or protocol, tested end to end.
$9k-$28k per engagement
2-4 weeks · 50% up front
Reserved capacity and deep research against a standing scope.
$14k-$32k per month
3-month minimum · billed monthly
Ranges, not a rate card. Scope sets the number: how many targets, how deep, how much of the work is reverse engineering, and how soon you need the window. The quote you get back is fixed for the scope it names - if the scope moves, you get a written change note and a new number before any extra work happens.
The same discipline in all three. What changes is how much of your attack surface it is pointed at, and for how long.
| Capability | Recon | Assessment | Engagement |
|---|---|---|---|
| Surface mapping | Full, inside the fixed window | Full, plus internal paths in scope | Continuous, re-run each cycle |
| Manual testing | Spot checks on the highest-value paths | Every in-scope path, by hand | Rolling, follows what you ship |
| Exploitation to a working proof | not included | Yes, where it is safe to demonstrate | Yes, including chained paths |
| Binary and protocol reverse engineering | not included | One scoped target | Ongoing, several targets |
| Source-code review | not included | Where the code is available, priced in | Included |
| Written deliverable | Ranked findings list with evidence | Full report, reproduction per finding | Report per cycle, quarterly summary |
| Severity rating | CVSS v3.1 vector | CVSS v3.1 vector and business impact | Same, tracked across cycles |
| Retest after fixes | not included | One round, inside 60 days | Continuous |
| Debrief with your engineers | 30 minutes | 60 minutes | Every cycle |
| Tooling handed over | not included | Harnesses written for your target | Harnesses and source |
| Channel while the work runs | Email, encrypted on request | Shared encrypted channel | Shared channel, named response window |
Two models. One buys a finished piece of work, the other buys reserved time. Both are agreed in writing before anything technical moves.
You send targets, constraints and the window you want. Back comes a written scope and one fixed price for it, or a clear no with the reason.
Mutual NDA first, statement of work second. Both signed before a credential, a build or a network diagram changes hands.
Half the quoted fee, invoiced on signature. The window is held once it clears, which is what the deposit is actually for.
The agreed window, with a short status note at the halfway mark. Anything critical goes to you the day it is found, not in the report three weeks later.
Report, debrief, then the retest window. The remaining half is invoiced with the report and payable net 14.
If nothing exploitable turns up, you still get the report, the methodology and the evidence trail - and that result is worth having in writing. The fee pays for the work, never for a finding count.
One scope document covering the product line rather than a single build, with a reserved block of days against it each month.
Billed monthly, before the month it covers. No deposit on a retainer - the notice period does that job instead.
Each month runs to an agreed focus: a new build, a protocol change, a fuzzing campaign, a regression you want chased down. Priorities are set at the start of the cycle and can be traded mid-month.
Unused days roll forward one month, once. They are not a bank and not refundable: the fee holds capacity whether or not you spend it.
Thirty days of written notice either way. Work in flight is finished and handed over, access is revoked and evidenced, and nothing is left half-reversed on your systems.
A retainer day costs less than the same day bought inside a one-off engagement. That is the trade: you are paying to reserve capacity ahead of time, not negotiating a discount after the fact.
Some of this opens up with the right paperwork. Some of it does not open up at all, and no budget changes that.
Authorised testing only, written scope required, coordinated disclosure as standard. The same line applies in the other direction: unsolicited testing of shellcode.gg infrastructure is not authorised. If you have already found something, send it through the intake.
Two ways to pay, both deliberately boring. Nothing about the fee changes with the method you choose.
Issued in USD and payable by bank transfer. Deposits are net 7, balances net 14. Purchase-order references, supplier forms and vendor onboarding are fine - send them with the scope, not after the invoice.
Taxes and duties are stated on the invoice where they apply.
Quoted in USD and converted at the rate on the invoice date, so exchange movement between invoice and settlement is mine, not yours.
The address arrives over the encrypted channel and is confirmed out of band before you send anything. Never pay an address that reached you in a plain email - including one that appears to be from me.
Half up front on engagements, the balance with the report. Retainers are billed monthly in advance. Expenses - hardware, licences, cloud time - are quoted at cost and agreed before they are incurred.
Escrow through a third party both sides accept is fine where procurement requires it; the fee is unchanged.
Cancelling inside seven days of a booked start keeps the deposit: the window was held and nobody else could take it. Cancel earlier than that and the deposit comes back in full.
From the first email to the retest, with the waiting marked honestly rather than hidden behind a sales process.
t+0
Target class, rough scope and the window you are aiming at. Encrypt it if the detail is sensitive; the key is on the contact page.
t+2d
A scope document and one fixed price, or a no with the reason behind it. Two working days is the normal case, not the best case.
t+1w
NDA and statement of work executed, deposit invoiced. How fast this step moves is usually down to your legal team, not to me.
t+2-4w
Recon normally starts inside two weeks. Assessments book two to four weeks out. Retainers start on the first of a month.
5d-4w
Five working days for recon, two to four weeks for an assessment, a standing block of days per retainer month. Critical findings do not wait for the end of it.
+3d
Draft within three working days of the last test day, debrief inside a week of the draft, corrections folded into the final version.
+60d
Sixty days from delivery to get the included retest round on an assessment. Retainers retest continuously, so the clock does not apply.
next step
A written scope and a fixed quote, or a clear no with the reason. Questions about NDAs, retests, jurisdiction and disclosure are already answered in the FAQ.