Our prices are fixed and published

Ghost Protocol’s penetration test is a fixed $4,000, the whole web-and-API VAPT engagement, not an hourly estimate. For comparison, published 2026 cost guides (DeepStrike, Blaze Infosec, Intruder, Astra) put an equivalent engagement from a traditional firm at $5,000 to $35,000 once scoping, hours, and change orders are counted, and the AI-only platforms list from $3,500 per test. We quote one number and hold it: no hourly billing, no scope creep. Expedited 72-hour delivery is $500 extra, and the ongoing security retainer is $899/month. Companies registered in Sri Lanka have a local rate card. Read the full penetration testing cost guide for the market math and how to compare quotes.

A fixed-price engagement in which an engineer tries to break into your web app or API by hand, after PhantomDragon, our scanning engine, has swept it with 75+ scanner modules: one application plus its API, up to three hostnames, grey-box with two user roles. You get an executive-readable PDF report, developer JSON + SARIF, reproducible proof-of-concept for each high-severity finding, a free re-test after you patch, a 30-day Q&A inbox, and a signed attestation letter for auditors. Delivery is 5 to 7 days. No hourly billing and no scope creep.

The Ghost Scan at ghosts.lk/scan is free forever, no signup, no credit card. It’s an automated surface-level check of publicly visible configuration; what we keep from a scan is set out in our privacy notice. Wyrm is also free to use locally with no limits, and a free 15-minute consult is available before any paid engagement.

The free Ghost Scan is an automated check of publicly visible configuration. The $4,000 penetration test is a manual deep-dive: an engineer tries, by hand, to exploit your application logic, authentication, and infrastructure, then hands you a report written for your auditor. The free scan tells you if anything obvious is exposed; the pentest tells you whether someone can actually break in.

Yes. The security retainer is $899/month on a six-month minimum and works as continuous penetration testing: a fresh pentest every quarter, a monthly deep scan with a delta report between engagements, re-tests on every fix, priority triage when something breaks, the same engineer each quarter, who knows your codebase, and a quarterly summary you can file with your auditor. It costs less than the four pentests and twelve scans bought separately. It is not a 24/7 service; the response commitment is same business day, in writing.

Yes. Standard delivery is 5 to 7 calendar days. Expedited 72-hour delivery is available for an extra $500. Most engagements don’t need it: SOC 2 auditors are comfortable with the standard 5 to 7 day turnaround.

Yes. Companies registered in Sri Lanka are invoiced in LKR at a local rate card, a separate price for the local market rather than a conversion. The figures are on the penetration testing in Sri Lanka page.

The free tier is free to use with no usage limits, install it via npm (wyrm-mcp), run wyrm-setup, and add it to your MCP config; no account is needed for local use. Wyrm is proprietary software (the Wyrm Terms of Service apply); your memory stays local on your machine. Paid plans add cloud and team features: Pro is $29/month (cloud sync, AES-256 encryption), Team is $199/month (shared memory, up to 25 seats), and Enterprise is $499/month (SSO/SAML, custom SLA, on-premise option). They are arranged by email, not a checkout: write to support@ghosts.lk.

DragonScale is a self-hosted commerce platform with no monthly fees and no per-order commissions, you own your data and infrastructure. It’s deployed in Starter, Business, and Enterprise tiers scoped to your needs, so pricing depends on locations, customization, and support level. Contact us for a tailored quote.

Four structural reasons. About four engineer-days go into each engagement, billed at a Colombo rate rather than a US one. PhantomDragon, our own scanning engine with 75+ scanner modules, does the coverage work, so those days go to exploitation and chaining instead of enumeration. The scope is fixed (one web app plus its API), so there is no scoping overhead. And there is no platform fee and no sales team between you and the engineer. The method is OWASP / NIST, the report is built for auditors, and the engineer who led the test signs the attestation letter; only the overhead is lower.

Those lines are drawn by firms selling $5,000+ tests, and the platforms themselves now sell $1,999 to $3,500 AI-only products under the word pentest. Ours is $4,000, so it sits above that line, but what makes it a pentest is not the price. An engineer runs the manual phase, every high-severity finding ships with a reproducible proof of concept, a free re-test follows your fixes, and the engineer who led the test signs the attestation letter. The sample report shows all four.

It is written for them: a scope statement, the method (NIST SP 800-115 and OWASP), findings ranked by severity, an executive summary, remediation guidance, and a signed, dated attestation letter. For SOC 2 and ISO 27001 the test is the evidence auditors look for (CC4.1, and A.8.8 with A.8.29). For PCI DSS it covers the external application-layer part of requirement 11.4 only: 11.4.3 and the 11.4.4 re-test. Internal and segmentation testing are not included. Acceptance is your auditor’s decision, so read our example report first: it is public, all 15 pages.