Skip to content
Raven Security
Menu

Pricing

Published fixed prices. No subscription. Fixes confirmed.

Every plan is a complete engagement: a review of your predefined scope by our security models and reviewers, an OWASP-mapped report with proof, Q&A support while your team fixes, one complimentary re-scan, and a signed 1-page Letter of Attestation.

Site

Small business

$1,800

Your public website and perimeter, tested from the outside the way an automated or AI attacker sees it.

A marketing site, brochure site, or storefront with no custom customer login. Built for small businesses that want to catch forgotten plugins, exposed files, and public misconfigurations fast.

Included

  • One public website across up to 3 predefined hosts or subdomains
  • Pages, forms, scripts, and endpoints a visitor can reach without signing in
  • Check for outdated CMS plugins, frameworks, and publicly indexed private files
  • Prompt-injection and key-exposure check on any public AI chat or search widget
  • A report ordered by what to fix first: what is wrong, why it matters, the proof, and what to change
  • An 'Observed, Not Tested' list of external domains or systems linked from your site
  • Answers to your team's questions while they make the fixes
  • One complimentary re-scan of the same scope within 45 days, plus a 1-page Letter of Attestation

Not in this plan

  • Areas behind a customer, staff, or admin login
  • Deep multi-role RAG or authenticated AI agent testing (available as an add-on)
  • A subscription, an agent to install, or a dashboard to watch
Request the Site plan

Application

Most popular

$4,500

One web application and its APIs, tested from the outside and from inside every login role you give us.

A customer portal, SaaS product, booking tool, or internal web app where customers, contractors, or staff sign in. This is where permission drift and business-logic bugs hide.

Included

  • One web application and its public marketing site (up to 4 predefined hosts)
  • Up to 3 logins you provide (for example: customer, staff, and admin), each tested for access it should not have
  • Business-logic and multi-step workflow testing across forms, APIs, and exports
  • Baseline security check of in-app AI assistants or search features
  • A report ordered by what to fix first, mapped to OWASP standards, with attached proof and remediation steps
  • An 'Observed, Not Tested' list of external domains, ERPs, or vendor hosts linked from your app
  • Answers to your developers' questions while they fix
  • One complimentary re-scan within 45 days, plus a signed 1-page Letter of Attestation for customers or insurers

Not in this plan

  • A second, separate software product under the same company
  • Office networks, employee laptops, or staff phishing
  • A subscription, an agent to install, or a dashboard to watch
Request the Application plan

Infrastructure

Mid-size organization

$9,500

Up to ten of your internet-facing hosts, applications, and AI workflows, tested together the way attackers chain them.

Mid-size companies running multiple portals, APIs, file hosts, AI copilots, and legacy subdomains—or preparing for an enterprise security review, cyber insurance renewal, or SOC 2 / ISO audit.

Included

  • Up to 10 internet-facing hosts or subdomains named in your written scope
  • Up to 2 distinct web applications and up to 6 test logins across roles and tenants
  • Full AI & Agent Deep-Dive included: cross-account RAG leakage, tool-calling permissions, indirect prompt injection, and API key / spend exposure
  • Chained-path testing across your public sites, portals, APIs, and forgotten staging hosts
  • OWASP-mapped technical report with proof, plus an Executive Summary and 1-page Letter of Attestation for auditors, enterprise buyers, and cyber insurers
  • An 'Observed, Not Tested' inventory of linked ERPs, third-party services, and out-of-scope hosts discovered during testing
  • A live walkthrough call with your engineering or IT lead, plus Q&A support while you fix
  • One complimentary re-scan of the full scope within 60 days of the report

Not in this plan

  • Hosts or third-party vendor systems not on the signed written scope
  • Office networks, physical security, or staff phishing
  • A subscription, an agent to install, or a dashboard to watch
Request the Infrastructure plan

Modular options

Add-ons & repeat reviews

Keep the base plan simple, and add extra depth or roles only when your environment needs it.

AI & Agent Feature Deep-Dive

+$1,500

Add to Site or Application (already included in Infrastructure)

For companies shipping a customer chatbot, RAG search over company documents, automated intake forms, or tool-calling AI agents.

  • Cross-customer RAG & vector search leakage (testing whether Account A can prompt the AI into quoting Account B's records)
  • Tool-calling & 'confused deputy' checks (verifying the AI cannot invoke privileged backend actions or query other users' IDs)
  • Indirect prompt injection via forms, tickets, or uploaded documents that an internal AI later reads
  • System prompt extraction, leaked LLM API keys, and unthrottled endpoint ('denial-of-wallet') checks

Extra Logins or Hosts Pack

+$750

Per 2 additional login roles or 3 additional hosts

Straightforward math when your application has more permission tiers (such as regional managers, dealers, or read-only auditors) or a few extra subdomains.

  • Adds 2 authenticated user roles or 3 predefined hosts to your written scope
  • Covered by the same complimentary re-scan window as your base plan

Annual or Post-Launch Re-Verification

25% off plan rate

Returning clients testing the same scope within 12 months

We don't sell subscriptions. If you want a fresh review and updated Letter of Attestation a year later—or after a major release—you get a flat 25% repeat reduction.

  • Full review of the updated scope, new report with proof, and a fresh complimentary re-scan
  • Updated 1-page Letter of Attestation for annual customer questionnaires, SOC 2, or insurance renewals

What you see is what you pay

Published prices are in US dollars and cover the hosts and logins written on each plan. Canadian clients contracting through our Toronto office (Raven Security Inc.) may request invoicing in USD or CAD. If your list is larger than a plan allows, we quote a fixed price in writing before any work starts. We never begin on a guess and invoice the difference later.

Every plan includes a complimentary re-scan and Letter of Attestation

Within 45 days of the report (60 days on the Infrastructure plan), once your fixes are in, we test the same scope again at no charge. The updated report marks each item Closed or Still Open with fresh proof, and we issue a 1-page Letter of Attestation you can share with enterprise buyers, cyber insurers, and SOC 2 or ISO 27001 auditors.

Nothing starts without your written approval

Choosing a plan does not authorize a review. Authorization is a short written scope naming the exact domains, login roles, and dates, signed by someone with the authority to approve it. Read the process page for how scope boundaries and production guardrails work, or download our overview & sample report PDF to share with your team.

Scope a reviewDownload sample report & brochure (PDF)