Pricing
A public price per application.
The standard price is published: no scoping call to find out what it costs. All amounts exclude VAT.
Offers
SpectrAI Pentest
The pentest of a web application, from domain proof to report, with a targeted retest.
€2,490excl. VAT
per eligible application
Set up my pentest- External pentest of the application and its associated APIs, within the approved scope
- Authenticated tests with the test accounts you provide
- Autonomous execution, controlled exploitation, live follow-up in the cockpit
- Attack chains when they are demonstrated
- Proof preserved, reviewed by a human before publication
- PDF report: impact, CVSS, CWE, recommendations
- One targeted retest within 60 days of the report’s publication
SpectrAI Continuous
4 scheduled pentests over the year, with history and fix tracking.
€6,990excl. VAT
per application per year
Set up Continuous- 4 pentests over 12 months, one per quarter, each with the content of a SpectrAI Pentest
- Pentest history, tracking of vulnerabilities and of their fixes
- One targeted retest per pentest, within 60 days of its report
- Report and proof kept for each pentest
- Client space open for the 12 months
4 pentests on scheduled dates: this is not a permanent test.
SpectrAI Enterprise
For applications outside the standard scope and for specific requirements.
On quote
depending on the scope
Request a quote- Complex applications: several domains, SSO, MFA, VPN
- Multiple scopes
- Specific requirements, defined with you
- Additional human involvement
Do you resell pentests?
Security firms and MSPs go through the partner program: free console, white label, free resale price. Partner terms are shared once your account is validated.
Standard scope
What an eligible application is.
The fixed price applies when the application fits within these bounds. SpectrAI checks it from what you declare, before any payment.
At the standard price
- A web application served over HTTPS under a single domain verified through DNS, associated APIs included when they sit under that domain.
- At most 10 URLs or journeys declared in the scope.
- At most 2 test accounts, one per role, with no third-party SSO and no mandatory MFA on those accounts.
- Reachable from the Internet, with no VPN, no IP allowlist for you to set up, and no blocking captcha on the journeys to test.
- A test that fits within the standard execution envelope (consumption and turn caps).
On quote, Enterprise offer
- Several domains or several applications in a single scope.
- Third-party SSO, mandatory MFA, VPN or a blocking captcha.
- More than 10 URLs or more than 2 test accounts.
- A test that exceeds the standard execution envelope.
Not covered, whatever the price
- Internal infrastructure and networks.
- Mobile applications.
- Source code and repositories.
Ordering
How ordering works.
No online payment. Nothing runs before the scope and the authorization are explicitly validated.
Declare the application
Create your space and declare the application’s URL, its scope and your test accounts.
Verify the domain and the authorization
You publish a DNS TXT record that proves you control the domain. You authorize testing this scope by accepting the quote.
SpectrAI checks eligibility and sends the quote
We check that the application fits the standard scope, then send you the quote. An Enterprise scope is priced separately.
Accept the terms and pay
You accept the quote and the terms in your space. Payment is made against an invoice, offline.
Scheduling, then execution
Once the order is paid, you schedule or launch the pentest from your space, then follow it in the cockpit.
Frequently asked questions
Pricing questions.
Do the prices include VAT?
No. Every published price excludes VAT. The applicable VAT is added on the quote and the invoice.
What is an application?
A web application served over HTTPS under a domain you verified through DNS, with its associated APIs under that domain, within the standard scope. Each application is declared, verified and tested separately: for several applications or several domains, request an Enterprise quote.
What if no vulnerability is demonstrated?
The price pays for the test and the report, not for a number of vulnerabilities. A result with no demonstrated vulnerability is valid: the report states the scope tested and the coverage declared by the agents.
How long does a pentest take?
The duration depends on the application. We publish no guaranteed turnaround. Once the pentest is launched, you follow its progress live in the cockpit.
What does the retest include?
One targeted retest, within 60 days of the report’s publication, on the vulnerabilities you marked as fixed. It covers the URLs concerned, does not use up a pentest, and returns a verdict per vulnerability (fixed or still present), not a new full report.
What is the difference between Pentest and Continuous?
Pentest is a one-off pentest of an application. Continuous bundles 4 pentests over 12 months, one per quarter, with history, fix tracking and one retest per pentest. It is not a permanent test: each pentest has its scheduled date.
When do I need Enterprise?
When the application falls outside the standard scope (several domains, SSO or mandatory MFA, VPN, blocking captcha) or when you have specific requirements. The quote is prepared through the contact form.
I am a security firm or an MSP: can I resell SpectrAI?
Yes, through the partner program: free console, white label on the portal, the emails and the reports, free resale price. Partner terms are not on this page; they are shared once your account is validated.
Get started
Start by declaring your application.
You see the price before you commit, and nothing runs without your explicit agreement on the scope.