Fees
No qualifying finding, no fee.
A verified finding is charged at its severity band. The cap is per assessment, not per finding. Figures below are standard defaults in USD. They bind only when signed.
| Severity | Fee |
|---|---|
| Info | $0 |
| Low | $500 |
| Medium | $1,500 |
| High | $4,000 |
| Critical | $10,000 |
| Assessment cap | $15,000 |
Assessment cap
The default cap is $15,000 per assessment. Charges stop at the signed cap even if the sum of bands would be higher. The cap is not multiplied by the number of findings.
If nothing qualifies
If the assessment produces no qualifying finding, there is no fee. Qualifying means verified, in scope, and inside the signed rules. Info is billed at $0.
Never charged
These items are recorded when useful. They are not billed.
- Unverified scanner output
- Version banners
- Duplicate findings
- Issues outside the signed scope
- Best-practice notes with no attack path
- Self-XSS
- Missing headers without an attack path
- Issues that would need destructive or prohibited tests to prove