How much does a penetration test cost in India? A 2026 guide

The most common question we get on scope calls is not technical. It is "what will this cost?" and the honest answer is more useful than the sales answer. Here is how penetration test pricing in India actually works in 2026, from a firm that quotes them.

The one-line answer

A serious manual penetration test in India typically lands between INR 75,000 and 4,00,000 (roughly USD 900 to 4,800) depending on scope. Below that range you are usually buying a scanner with a report template. Red team and hardware engagements sit higher and wider, from five to six lakhs into seven figures for multi-month programs.

What actually drives the price

• Surface breadth. One web application with 30 dynamic endpoints is a different universe from "all our customer-facing systems." Breadth is the first multiplier.
• Depth requested. A checklist test against the OWASP Top 10 costs less than business-logic abuse research and exploit chaining. Depth is the second multiplier.
• Environment type. Cloud with multiple trust boundaries, thick mobile clients, or embedded hardware each add specialized skills.
• Timeline. Compressed deadlines mean a researcher drops other work. Rush premiums are real.
• Retest and reporting depth. An executive brief plus technical report plus a free retest is more work than a findings list. It is also the difference between a document and an outcome.

What cheap tests skip

When a quote looks too good, the missing line items are consistent: no manual verification of scanner output, no exploit chaining, no business-logic testing, no retest. You receive a renamed scanner export. It satisfies a checklist and detects nothing a free scanner would not have found.

The expensive pentest is the one that misses the finding an attacker finds three months later.

When to spend less

Honest version: a pre-revenue startup with no sensitive data does not need a three-lakh red team exercise. A scoped assessment of your auth flows and payment integrations, plus quarterly vulnerability assessments, is the right first step. We tell prospects this on scope calls, because trust compounds and engagements renew.

Questions that reveal quote quality

• Who exactly tests, and can we talk to them before signing?
• What percentage of findings will be manually verified?
• Is the retest included, and for how long after delivery?
• What does the report look like: do sample reports exist?

If you want a number for your specific stack, book a free scope call. You will get a fixed price after one conversation, not a vague range after three follow-up emails.