Every Bachao.AI engagement includes the full scan, validated findings, CVSS v3.1 severity scoring, CERT-In alignment statement, DPDP Act 2023 Schedule I mapping, and remediation written for your tech stack — Next.js, Django, Spring, Rails, .NET, PHP. Scope-based pricing means you pay for the actual surface scanned, not a flat catalog rate that ignores whether you're a single-product startup or a 12-microservice scale-up.
Full OWASP Top 10 + OWASP API Security Top 10 + business-logic + auth-flow checks
CVSS v3.1 scored report with reproduction steps + remediation
CERT-In alignment statement included
DPDP Act 2023 Schedule I mapping included
Retest after fixes — scoped into the engagement, not billed separately
Dashboard + API access during and after the engagement
India VAPT market rates — public benchmarks
We've collected publicly listed rates from the major Indian VAPT firms so you can sanity-check any quote you receive:
Progressive Techserve — annual subscription per web app (progressive.in)
Hidden costs in manual VAPT engagements
The headline figure rarely matches the final invoice. Common line items not quoted up front: engineering hours servicing the engagement (8–16 hrs of senior dev time per scoping cycle); retests after fix delivery (often billed at 30–50% of the original engagement value); compliance mapping if the firm doesn't include CERT-In or DPDP alignment by default; report revision rounds if findings are noisy or scoped wrong. A low initial quote can easily double by closure once retests and compliance mapping are added.
How Bachao.AI scope-based engagement works
We scope each engagement on a 30-minute call: target count, surface depth, retesting cadence, compliance frameworks to map, CI/CD integration. The output is a written scope document with a fixed engagement fee — no overruns, no surprise retest billing. Result: materially lower TCO than the manual market rate cited above, with continuous scanning supported on top of the engagement.
Frequently asked pricing questions
How is the first scan really free? We run the full automated scan on your target and email you the executive summary. You pay only if you want the deep report with full findings, remediation, compliance mapping, and CI/CD integration. There's no card on file, no auto-conversion.
Do you offer annual commitments? Not by default. Most engagements are scope-based and per-cycle; we offer annual plans only if a customer specifically requests one and the scope spans multiple products.
Is there a per-seat fee? No. The platform is priced by scope of work, not by user count.
Get a real quote in 30 minutes
Click Get a scoping call. Share your stack, target count, and active compliance perimeter. We'll respond within 24 hours with a 30-minute slot and a one-page scope outline you can share with your CFO before the call.
Pricing should be a 30-minute conversation, not a discovery dance
Book a free scan + a scoping call. No commitment, no hard-sell.