Web application penetration testing cost in India
A plain account of what a web application test costs, why one application costs more than another, and where BERRY9's starting prices sit against what other vendors publish. We work from Hyderabad and serve companies throughout India.
- Starter scope
- From INR 9,000 + GST
- Web application
- From INR 27,000 + GST
- Typical duration
- 5 to 10 working days
- Market figures read
- 30 October 2026
Last reviewed
01 / BERRY9 price
What BERRY9 charges for a web application test
We publish two starting prices. An application with logins and roles falls under the second.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
It is meant for small, well-defined targets, so it does not cover the test on this page.
- A vulnerability scan
- Manual checks
- A written report
Web application with logins and roles
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST.
A starting price, not a flat fee: your application's figure is fixed in a written proposal after scoping.
- Manual testing signed in as every role
- Executive and engineering reports
- A CVSS 3.1 score on every finding
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
02 / Price drivers
What moves the price of a web application test
Five things decide the testing time, and the price follows it.
Testing time sets the price, and five properties of an application decide how much time it needs. Each is a question we ask during scoping.
Roles
Customer, staff, manager and administrator are separate sets of permissions. Each pair of roles is a possible privilege escalation, so a fifth role adds far more than one more login.
Functions
A contact-form site offers visitors almost nothing to do. A portal with orders, approvals, exports and settings offers dozens of actions, and every action is a spot where a check could be missing.
Background interfaces
Pages quietly call interfaces of their own. The more there are, the more requests need an authorization check, so a busy hidden API makes the test longer than the screens suggest.
Integrations
Payment gateways, single sign-on, file storage and partner feeds pass data across a boundary. We test your side of each; the provider's side stays out of scope unless the provider agrees.
Environments
A single staging copy is the easy case. Add a production window, a second region or several tenants and each one costs setup and testing time.
03 / Examples
Four kinds of web application, priced
Two starting prices cover a wide spread of applications, so it helps to see where yours is likely to fall.
Show details for Four kinds of web application, priced
Four kinds of web application come up most often. The table shows what makes each one bigger and which of the two starting prices it falls under. It carries no other figures, because the final price is set after scoping.
| Application | What makes it bigger | Where it lands |
|---|---|---|
| A brochure or WordPress website | Few pages, one kind of visitor, usually a contact form and an editor login | While the site stays simple it fits the starter scope, which begins from INR 9,000 + 18% GST |
| A customer portal | Customer and administrator roles, account pages, downloads, one or two integrations | Priced as an application test, from INR 27,000 + 18% GST, for a typical portal |
| A multi-tenant software product | Several roles inside every tenant, tenant isolation to prove, a big API, more than one environment | The same entry point of from INR 27,000 + 18% GST, although roles and tenants usually lift the final figure |
| An online store | Accounts, baskets, payments, order history, discount and refund logic, an admin console | Priced as an application test, from INR 27,000 + 18% GST, once the payment flow is scoped |
04 / Market figures
What other vendors publish for a web application test
Show details for What other vendors publish for a web application test
Other vendors publish their own guides, and the ones we read on 30 October 2026 give these figures for a web application. They come from the vendors' marketing pages and are not audited averages, so use them for a sense of the range and not as a benchmark. Rupee amounts exclude GST unless the source says otherwise.
- Astra Security's guide (17 February 2026 update) puts one web application tested by hand between 40,000 and 2,50,000 rupees.
- BM Infotrade, modified 21 July 2026, lists 25,000 to 2,50,000 rupees for each application, with a basic brochure site at about 25,000.
- Cybersecify, in 2026, names 75,000 rupees as the least it says an auditor will accept for a manual test.
- In September 2026 Ostorlab listed US$3,000 to US$18,000 for a hand-tested web app or API.
- Invadel lists a web application from US$5,200 on its site, with no date.
Laid side by side, the Indian figures for a manual test of one application begin somewhere between 40,000 and 75,000 rupees and climb to several lakhs. Scopes differ, so check what each vendor's figure includes before you compare it with a proposal.
Figures for every kind of test, each with its source, are in the VAPT cost guide for India.
05 / Website security audit
Website security audit cost
The phrase stretches from a scan of a small site to a full application test, so the price depends on which one you mean.
Show details for Website security audit cost
People search for a "website security audit" when they often mean a penetration test, and vendors use the phrase loosely. For a website it generally means a scan plus manual testing, written up in a report. The label does not set the price; the scope does.
A simple website
A brochure site or a simple WordPress website fits the starter scope, with prices from INR 9,000 + 18% GST.
A site with logins
The moment visitors sign in and see different things, you need an application test, priced from INR 27,000 + 18% GST.
What others publish
Astra's page on website security audit cost shows 2,00,000 to 12,50,000 rupees for the manual penetration testing part of an audit, and says a whole audit starts at 35,000 (2026, seen as a search excerpt).
BERRY9 tests and reports; we do not certify or audit organizations. Our report is evidence for your auditor to weigh, not an audit opinion.
06 / Get a price
What to send for an accurate price
Show details for What to send for an accurate price
A price is only as exact as the scope behind it. Send these six items and we can price your application without rounds of questions.
- The addresses of every application in scope, and which environment each one is.
- The roles it has, with one test account for each.
- A rough list of the main functions, or a staging copy where we can see them.
- The integrations that touch it: payments, single sign-on, storage and partner feeds.
- Any deadline, like an audit date or a customer security review.
- Anything we must not touch, such as a live payment flow or a shared production database.
If something is unknown, say so. The proposal then names the assumption it rests on, so a surprise later is a conversation and not a dispute.
07 / Inquiry
Ask for a proposal
Describe the application, its roles and your deadline, and we reply with a proposed scope and a price for that scope. To talk it through first, call +91 86868 92922 or email contact@berry9.com.
08 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
How much does web application penetration testing cost in India?
BERRY9 begins testing an application that has logins and roles from INR 27,000 + 18% GST. Indian vendors that publish a figure for one manual test mostly begin between 40,000 and 75,000 rupees. Your own price comes from the written proposal that follows scoping. See the section on What BERRY9 charges for a web application test above.
How much does a website security audit cost?
Simple sites sit in our starter scope, from INR 9,000 + 18% GST. A site where people sign in is an application test, from INR 27,000 + 18% GST. Other vendors publish wider ranges because "audit" covers different amounts of work at different firms. See the section on Website security audit cost above.
Is the price based on pages or on the whole application?
On neither count alone. Time decides the price, and time depends on roles, functions, background interfaces, integrations and environments. A hundred-page site with one kind of user can cost less than a twenty-page portal with intricate permissions. See the section on What moves the price of a web application test above.
Is GST included?
No. GST is extra: 18% is added to every BERRY9 figure on this page. When you compare with another vendor, check whether its number already includes tax.
Does the price include a retest?
The free retest belongs to the small starter scope. For an application test, the proposal sets out whether a retest is included and how it works before you commit.
How long does the testing take?
Most web tests finish within 5 to 10 working days of starting. Many roles, several tenants or heavy integrations lean toward the upper end; the proposal lists the dates.
Why do proposals for the same application differ so much?
Each vendor prices a different amount of work. One may lean on automated scanning and another on manual testing, and they may cover different roles, environments or follow-up. Match the scope of each proposal first, then compare the figures. See the section on What other vendors publish for a web application test above.
Will a low-priced test satisfy my auditor?
That is the auditor's call. Evidence for SOC 2, ISO 27001 or PCI DSS usually calls for broader scope and a more detailed report than a small test provides. Tell us what the auditor asked for before we scope.