No seat licences, no scanner per asset billing. We scope to your real attack surface and the depth you need, give you a fixed quote before any work starts, and include retests so a fix is proven, not assumed.
Vesper runs a deep authenticated pentest at machine speed, with proof on every finding. It is priced by application size, so you know up front whether you fit the flat price or need a quote. A manual web app pentest runs $10,000 to $25,000 and takes weeks. Vesper gives you a verified, authenticated result you can repeat every release.
One mid size application, web or API
A complete authenticated, multi role scan on the Deep profile. One flat price for a typical mid size app.
Up to 5 mid size apps · 20 deep scans / year
A pooled allowance of 20 deep authenticated scans. Think quarterly rescans on 5 apps, or monthly on one or two.
Large or complex apps, big API estates
A custom quote on real scope: endpoint and page count, roles and auth complexity.
Every plan runs Vesper's full module set at your chosen depth, and the report states what was tested and what was not, from the CLI or the governed console, with or without AI. We confirm the exact scope with you in writing before an assessment starts, so there are no surprises. Prices are in USD and exclude any applicable tax.
Our rule of thumb is roughly 50 API endpoints and an 8 to 10 page or view app. Most startup and growth stage products fit comfortably, and if yours does, the flat $2,000 price applies.
Large or very complex apps and big API estates are quoted on real scope: endpoint and page count, the number of roles, and how involved the authentication is. Tell us the shape of your app and we size it quickly.
One complete authenticated assessment run of an application at your chosen depth, Quick, Standard or Deep, including the adversarial verification pass and all reports.
We agree the exact scope with you in writing before the assessment starts. If your app sits above the mid size envelope, we say so up front and quote it, so the price never moves once work begins.
Twenty deep scans pooled across up to five mid size applications in a year. Spend them how you like: quarterly rescans on all five, or near continuous testing on one or two priority apps.
On the one time assessment, the first fix verification rescan is included. On Annual, each rescan draws one scan from your pooled allowance.
For red team operations, bespoke business logic work and advisory, our offensive security services wrap researchers around the platform.
A rolling subscription. We test as you ship, watch your external surface, and surface findings the moment we confirm them.
A fixed scope assessment of a web app, API, cloud environment, mobile app or network, with a report your engineers can act on.
Adversary simulation against a goal you care about, testing detection and response, not just a checklist.
Continuous discovery of the assets, services and exposures an attacker would find first.
Price follows the size and complexity of what you actually want tested and the depth you need, not a per seat or per scan meter.
You get a written scope and a fixed quote before any testing begins. No surprises, no hourly creep.
Verifying a fix is part of the engagement, not an upsell. A finding is closed when we have broken it again and it holds.
Tell us the asset, the deadline and the decision you need to support, and we will map the right engagement and send a quote within a few hours.
Send us your target and timeline. We respond fast, with a clear scope and a fixed price.
Request a quote