Cybersecurity Pricing & Engagement Models
How Penough engagements are scoped and priced — assessment, retainer and managed service models, and what actually drives the number.
Executive Overview
How Penough Engagements Are Priced
Penetration testing, incident response and managed monitoring are priced by scope, not by a public price list — a single web application and a multi-site bank are not the same engagement. What we can be explicit about is the model: every quote follows a scoping call, states what is in and out of scope, and is fixed before work starts.
This page explains the engagement types, the variables that move the price, and what a quote from Penough includes. If you need a budget figure before scoping, tell us the asset count and the objective and we will give you a range.
Capabilities
Core Features & Arsenal
Fixed-Fee Assessments
VAPT, network configuration review and red team engagements are quoted as fixed fees against a defined scope and testing window.
Managed Retainers
SOC monitoring, DFIR retainers and continuous testing are billed monthly or annually, with the SLA tier defining coverage hours and escalation targets.
Scoping Call
A short technical call establishes assets, objectives, constraints and the reporting your stakeholders need — before any number is quoted.
Written Scope & Quote
Every engagement is documented: assets in scope, testing type, window, deliverables, assumptions and exclusions.
Training & Academy
Public and in-house courses are priced per seat or per cohort, separately from consulting engagements.
Procurement Support
NDA, purchase order, vendor forms and security questionnaires handled so the engagement can start once the scope is agreed.
Execution
Engagement Methodology
Why It Matters
Business Value Delivered
Every engagement is aligned to your strategic objectives — delivering measurable risk reduction and clear ROI for your organisation.
- No surprise line items: the quote states scope, deliverables and exclusions up front.
- Budget ranges available before a formal scoping call, based on asset count and objective.
- Retainers that convert an emergency into a phone call instead of a procurement delay.
- Reporting suited to the audience — technical detail for engineers, risk language for the board.
Questions Answered
Frequently Asked Questions
What procurement, finance and security teams ask before they request a quote.
How much does a penetration test cost in Bangladesh?
The fee is driven by scope: the number of applications, hosts and IP ranges, whether testing is black, grey or white box, the depth of manual testing required, and whether a retest is included. Because those inputs vary by an order of magnitude between a startup product and a bank, Penough quotes after a scoping call — and will give a budget range earlier if you provide the asset count and objective.
How much does a managed SOC retainer cost?
SOC pricing depends on log-source count, daily event volume, coverage hours (24/7 versus business hours), SLA tier, and whether Penough hosts the SIEM or monitors yours. Retainers are quoted as a recurring fee after scoping.
Is pricing fixed or scope-based?
Assessments are fixed-fee once the scope is agreed, so the number does not move during delivery unless you change the scope. Managed services are recurring and reviewed at renewal as your estate changes.
Do you offer retainers for incident response?
Yes. An IR retainer pre-agrees terms, contacts and access so an activation during an incident is immediate rather than delayed by procurement.
What does a quote include?
The written quote covers assets in scope, testing or monitoring approach, the delivery window, deliverables (technical report, executive summary, retest where applicable), assumptions, exclusions and validity period.
Are there hidden costs?
No. Scope changes requested mid-engagement are quoted before they are performed, and third-party costs — if any are needed — are stated in the proposal rather than billed afterwards.