A SaaS founder recently shared a VAPT quote they received: $2,500 for a "comprehensive penetration test" of their platform. Another quote for the same platform came in at $28,000. Both vendors used the same terminology. The $2,500 engagement was an automated vulnerability scan with a PDF report generated by a tool. The $28,000 engagement was a manual assessment conducted by human testers with application-specific exploit attempts. Only one of them would satisfy an enterprise customer's security questionnaire or an investor's due diligence requirement.
This guide explains what VAPT actually costs, what's inside each pricing tier, and how to evaluate whether a vendor is selling you real security testing or a compliance checkbox.
How Much Does VAPT Cost for a SaaS Product?
VAPT for a SaaS product costs between $3,000 and $60,000 depending on scope and methodology. Automated scanning-only engagements run $3,000-$8,000. Manual web application penetration testing starts at $8,000 and runs to $25,000 for a standard SaaS product. Full-scope assessments covering API security, infrastructure, authentication architecture, and business logic typically cost $20,000-$50,000. Annual continuous testing programs for enterprise SaaS products run $40,000-$100,000+.
What "VAPT" Actually Covers
VAPT - Vulnerability Assessment and Penetration Testing - is a compound term that covers two distinct activities often bundled together but meaningfully different:
Vulnerability Assessment (VA): Systematic scanning and enumeration of known weaknesses using automated tools. Fast, cheap, and produces a list of CVEs and configuration issues. Catches the low-hanging fruit that attackers would find with the same automated tools.
Penetration Testing (PT): Manual exploitation attempts by human testers simulating real attacker behavior. Requires domain expertise, time, and creativity. Finds vulnerabilities that scanners miss - business logic flaws, chained exploits, authorization issues, and application-specific attack paths.
Most "VAPT" engagements emphasize the VA heavily and include minimal PT. The ratio of automated-to-manual work is the primary driver of both cost and value.
Pricing Tiers for SaaS VAPT
Tier 1: Automated Scanning ($3,000-$8,000)
Automated tools (Nessus, OpenVAS, Burp Suite automated scans, OWASP ZAP) scan your application and infrastructure for known vulnerabilities, misconfigurations, and common weaknesses.
What's included:
- Network scan of external-facing infrastructure
- Web application scan (OWASP Top 10 automated checks)
- SSL/TLS configuration review
- Automated report with CVSS scores and remediation guidance
What's not included: Any manual testing, business logic analysis, authentication flow testing, API-specific testing, or chained exploit development.
Who trusts it: Internal security hygiene. Does not satisfy enterprise customer security requirements, SOC 2 evidence requirements, or investor due diligence for most rounds above Series A.
Turnaround: 3-7 days.
Tier 2: Manual Web Application Penetration Test ($8,000-$25,000)
A human tester systematically attacks your web application following a structured methodology (OWASP Testing Guide, PTES). The tester actively attempts to find and exploit vulnerabilities rather than just enumerate known ones.
What's included:
- Authentication and session management testing
- Input validation and injection testing (SQL, NoSQL, LDAP, command injection)
- Authorization testing (IDOR, privilege escalation, horizontal and vertical access control)
- Business logic flaw analysis specific to your application
- API endpoint enumeration and testing
- Manual exploitation of discovered vulnerabilities to demonstrate impact
- Detailed findings report with proof-of-concept exploits and remediation guidance
Scope variables that affect cost: Number of user roles (each role requires separate testing), number of API endpoints, presence of file upload functionality, payment processing components, real-time features (WebSockets), OAuth/SSO integration complexity.
Typical timeline: 1-3 weeks testing, plus reporting.
Who trusts it: Enterprise security questionnaires, Series B+ due diligence, SOC 2 Type II evidence requirements, ISO 27001 certification support.
Tier 3: Infrastructure + Application Assessment ($20,000-$45,000)
Extends the web application test to include cloud infrastructure, internal network components, CI/CD pipeline security, container and Kubernetes configuration, and IAM/access control architecture.
Additional scope:
- Cloud configuration review (AWS/GCP/Azure security posture, S3 bucket policies, IAM permissions, security group rules)
- Container security assessment (Dockerfile analysis, image scanning, runtime security)
- CI/CD pipeline review (secrets management, dependency security, deployment controls)
- Internal API and microservices testing (not just external-facing endpoints)
- Social engineering simulation (phishing test against development/operations staff)
Who this is for: Series B+ SaaS products, companies handling sensitive regulated data (health, financial, legal), enterprise customers requiring cloud security posture evidence.
Tier 4: Full Compliance-Scope Assessment ($35,000-$60,000+)
Designed to produce the security evidence required for specific compliance certifications or regulated customer contracts.
SOC 2 Type II: Penetration test is required evidence for the Security trust service criterion. Must be conducted by an independent assessor using a methodology auditors will accept.
HIPAA: Required security testing is less prescriptive than SOC 2 but healthcare enterprise customers typically require HIPAA-scoped assessments with risk analysis documentation.
ISO 27001: Penetration testing is referenced in Annex A controls. ISO auditors expect evidence of systematic testing against an established methodology.
PCI DSS: If you're processing cardholder data, PCI DSS 11.4 requires penetration testing by qualified personnel meeting specific scope and methodology requirements.
What Drives VAPT Cost Up or Down
Application Complexity
A single-page SaaS application with one user role and 30 API endpoints costs less to test than a multi-tenant platform with four user roles (admin, user, read-only, API), 150 endpoints, file processing, and payment flows. Testers price based on the attack surface, not the monthly revenue.
Number of User Roles
Each distinct user role requires independent authorization testing - a tester must verify that user A cannot access user B's data and that standard users cannot access admin functions. Every additional role multiplies the authorization testing scope.
Data Sensitivity
Applications handling financial data, healthcare records, or personal data in regulated jurisdictions receive more intensive testing because the consequences of a breach are more severe and compliance requirements are stricter.
Infrastructure Scope
Testing only the web application is cheaper than testing the application, its supporting infrastructure, its CI/CD pipeline, and its internal network. Many SaaS products have their real vulnerabilities in infrastructure configuration rather than application code.
Remediation Support
Some engagements include a retest after you've remediated findings - the tester verifies that the vulnerabilities are actually fixed. This adds cost but is often required for compliance evidence (the initial finding plus verified remediation is the evidence chain).
What to Ask a VAPT Vendor Before Signing
1. What percentage of testing is manual vs. automated? Any answer below 50% manual for a web application test should prompt follow-up questions. Automated tools are table stakes; human testers are what you're paying for.
2. What methodology do you follow? Acceptable answers: OWASP Testing Guide, PTES (Penetration Testing Execution Standard), OWASP WSTG. Vague answers about "industry best practices" are a red flag.
3. Will you provide proof-of-concept exploits in the report? A good penetration test report includes working exploits (or redacted evidence of exploits) that demonstrate actual exploitability - not just a list of CVEs with severity ratings.
4. Does the engagement include a retest? For compliance purposes, you typically need evidence that vulnerabilities were not only found but remediated and verified.
5. Who specifically will be doing the testing? Named testers with certifiable credentials (OSCP, CEH, CREST) are what you want. "Our team" is not sufficient.
6. What format is the final report? Executive summary plus technical findings is standard. The technical findings should include: vulnerability description, risk rating, evidence of exploitation, and specific remediation steps - not generic CWE descriptions copy-pasted from a database.
Common Mistakes SaaS Companies Make with VAPT
Testing too late. The most expensive time to find a critical vulnerability is after you've shipped to 10,000 customers. VAPT should be scheduled before a major release, before a large enterprise contract, or before a funding round - not after.
Testing the wrong scope. Many engagements test only the production web application and miss the API used by the mobile app, the internal admin panel, the webhook receivers, or the customer-facing API keys. Attackers don't limit themselves to your stated scope.
No remediation plan before testing. A penetration test that produces findings with no plan for addressing them is an expensive document. The testing should be timed so the development team has capacity to remediate findings before they become a compliance or customer liability.
Treating the report as the deliverable. The report is evidence of the testing. The actual deliverable is the improved security posture after remediation. Companies that collect reports without acting on findings have spent money on documentation, not on security.
For context on the specific vulnerabilities VAPT commonly surfaces in SaaS products, see our guide on critical vulnerabilities SaaS startups miss before launch. For AI-specific security concerns relevant to products using AI agents, see AI agent security risks.
Seven Labs' VAPT Engagements
At Seven Labs, our security engagements include manual penetration testing by certified engineers across web applications, APIs, cloud infrastructure, and AI systems. We work with SaaS companies at pre-launch (compliance readiness), post-Series A (enterprise customer requirements), and ongoing (annual continuous testing programs).
Every engagement includes a technical findings report with proof-of-concept exploits, an executive summary formatted for investor or customer presentation, a remediation roadmap with prioritized effort estimates, and a retest to verify critical and high-severity findings are resolved.
If you're preparing for an enterprise contract, a fundraising round, or a compliance certification, talk to our security team. We scope engagements to produce evidence that holds up to external scrutiny - not just internal reassurance.