top of page
logo

Select Your Tests

Choose the number of application penetration tests and external infrastructure blocks you require.

​

​

Unsure about your scope?

Review the guidance below and check any technical details with your IT team or developers before purchasing.

​

Alternatively, contact us if you need assistance.

Choose your tests, pay securely online and continue straight to the Test Details & Authority to Test form. Testing can begin within 3 working days, or on a future date that suits you.
Web Application & API Penetration Test
Web Application & API Penetration Test£2,950
External Infrastructure Penetration Testing
External Infrastructure Penetration Testing£1,800

Prices exclude VAT. VAT is added at checkout at the applicable rate.


I agree to the AppTest Direct Terms of Business.

OR

Prefer to order by invoice?

Need an invoice or a quote to raise a purchase order? We can help with your procurement process.

Order by Invoice

What's Included & Scope Guidance

Web application & API penetration testing

£2,950 + VAT

Fixed price per application

Included

  • One web application and its associated APIs, or one standalone API
  • Qualified tester-led penetration testing
  • Testing aligned with OWASP Top 10 guidance and application-specific risks
  • Manual security testing and investigations supported by automated testing
  • Unauthenticated and authenticated testing, where applicable
  • Controlled exploitation and tester verification of vulnerabilities​
  • Security testing of Generative AI and LLM integration wrappers, where applicable
  • Professional report with clear remediation guidance
  • Includes a complimentary retest

Application Scope Guidance

Designed for small to mid-sized applications, normally with 3 or fewer user roles, fewer than 20 dynamic web pages and up to 60 API endpoints or operations. Testing can also include one Generative AI or LLM integration wrapper, where applicable.

​

Larger applications can still be accommodated within the standard service, with manual testing prioritised around the highest-risk areas, critical functionality and specific areas of concern. This can provide useful security assurance where focused, risk-based testing is appropriate.

​

Where broader or more comprehensive coverage is required, contact us for a tailored quotation. We can allocate additional testing time based on the size and complexity of the application and agree the scope and pricing with you before testing begins.

External infrastructure penetration testing

£1,800 + VAT

Fixed price per block

Included

  • Up to 20 public-facing targets per block
  • Qualified tester-led penetration testing
  • Black-box testing from an external attacker’s perspective
  • Automated discovery and manual security investigation
  • Investigation and verification of vulnerabilities
  • Professional report with clear remediation guidance
  • Includes a complimentary retest

Infrastructure Scope Guidance

Each block covers up to 20 public-facing targets.

Examples:

  • 7 IP addresses = 1 block

  • 24 IP addresses + 3 fully qualified domain names (FQDNs) = 2 blocks

  • 50 IP addresses = 3 blocks
     

Each public IP address or FQDN counts as one target. CIDR ranges can be included, provided all addresses are authorised and counted towards the total.

 

Preparing for your test?

See our Preparing for Your Test page for guidance on test accounts, API documentation and access requirements.

What happens next?

1. Choose your tests

2. Complete your test details

3. We begin testing

Pay securely online, request an invoice or quotation.

Once your order or payment is confirmed, complete the online Test Details and Authority to Test form.

Testing normally starts within 3 working days of engagement approval, once all requirements are met, or on your agreed future date.

bottom of page