Pricing

Three plans for autonomous penetration testing

Standard is priced per domain. Premium puts web, mobile, code and cloud on one plan. Enterprise covers every input at scale, with SSO and AQSEC experts. Pay monthly, or yearly with 2 months free.

Book a demo Talk to sales

Standard / Premium / Enterprise

Three plans, one platform

Every plan runs all six agents, with benign proof and a retest on every assessment. They differ in what you can test, how often and what you receive.

Plan 01

Standard

One domain tested every month, with benign proof and two reports.

USD 299 a month per domainAED 890 a month per domainPKR 19,900 a month per domainUSD 2,990 a year per domainAED 8,900 a year per domainPKR 199,000 a year per domain

Billed monthly, on a 12-month termBilled yearly, upfront: 2 months free

Choose StandardChoose Standard

Who it is for Start-ups, SMBs and agencies with one main web app or API.

Included

1 domain: web and API, with its subdomains and APIs
1 Android app, as an add-on

Key features

1 assessment a month, with a retest within 30 days
Reconnaissance and Standard intensity
A monthly schedule
2 report templates, with PDF
OWASP Top 10 and MITRE ATT&CK v15.1
1 user, with email support

Or a one-off scan

USD 1,990AED 5,900PKR 99,000

1 assessment and 1 retest within 30 days, on one domain, with both reports.

Ask for a one-off scan

Plan 02

Premium

Web, mobile, code and cloud on one plan, with compliance evidence and your brand.

USD 1,490 a monthAED 4,390 a monthPKR 149,000 a monthUSD 14,900 a yearAED 43,900 a yearPKR 1,490,000 a year

Billed monthly, on a 12-month termBilled yearly, upfront: 2 months free

Choose PremiumChoose Premium

Who it is for Growing SaaS, fintech and e-commerce companies with a small security or DevOps team.

Included

5 domains
2 Android apps
3 code repositories
2 cloud accounts: AWS, Azure or GCP

Key features

A pool of 20 assessments a month, up to 4 Deep, each with a retestA pool of 20 assessments a month, up to 4 Deep, each with a retestA pool of 12 assessments a month, up to 2 Deep, each with a retest
Weekly or monthly schedules
The portfolio dashboard and report
5 report templates and CSV, with your logo and colours
NIST CSF 2.0, SP 800-53, SP 800-171, COBIT, the CIS cloud benchmarks, OpenSSF Scorecard and OWASP MASVS
10 users, next-business-day support and onboarding

Plan 03

Enterprise

Every input at scale, with SSO, your own deployment, an SLA and AQSEC experts.

From USD 6,000 a monthFrom AED 19,900 a monthFrom PKR 750,000 a monthFrom USD 60,000 a yearFrom AED 199,000 a yearFrom PKR 7,500,000 a year

Billed monthly, on a 12-month termBilled yearly, upfront: 2 months free

Talk to salesTalk to sales

Who it is for Banks, telcos, insurers, groups and government-linked bodies.

Included

20 domains
10 Android apps
20 code repositories
5 cloud accounts
2 Microsoft 365 or Google Workspace tenants

Key features

A pool of 60 assessments a month, up to 12 Deep, each with a retestA pool of 60 assessments a month, up to 12 Deep, each with a retestA pool of 36 assessments a month, up to 7 Deep, each with a retest
Daily, weekly or monthly schedules
All 8 report templates
The CIS and CISA SCuBA benchmarks for your tenants
SSO with your identity provider, on a dedicated deployment
Unlimited users, a named contact and an SLA
4 AQSEC expert days a year and 2 emergency runs a quarter

See how billing works, including taxes and regional pricing.

Compare the plans

Every feature, plan by plan. The price row follows the billing and currency you chose above.

Feature	Standard	Premium	Enterprise
Price	USD 299 a month per domainAED 890 a month per domainPKR 19,900 a month per domainUSD 2,990 a year per domainAED 8,900 a year per domainPKR 199,000 a year per domain	USD 1,490 a monthAED 4,390 a monthPKR 149,000 a monthUSD 14,900 a yearAED 43,900 a yearPKR 1,490,000 a year	From USD 6,000 a monthFrom AED 19,900 a monthFrom PKR 750,000 a monthFrom USD 60,000 a yearFrom AED 199,000 a yearFrom PKR 7,500,000 a year
What you can test
Domains: web apps and APIs	1, priced per domain	5	20
Android apps	Add-on: 1 app	2	10
Code repositories	Not included	3	20
Cloud accounts: AWS, Azure or GCP	Not included	2, up to 5 with add-ons	5
Microsoft 365 or Google Workspace tenants	Not included	Add-on: 1 tenant	2
Testing
All six agents on every assessment	Included	Included	Included
Assessments a month	1 per domain	A pool of 20; 12 on PKR plans	A pool of 60; 36 on PKR plans
Retest within 30 days	1 per assessment	1 per assessment	1 per assessment, more under fair use
Reconnaissance, up to once a day per target	Included	Included	Included
Standard intensity	Included	Included	Included
Deep intensity, on domains, apps and repositories	Not included	Up to 4 a month; 2 on PKR plans	Up to 12 a month; 7 on PKR plans
SchedulesQuarterly is arranged with AQSEC on any plan. An Android app needs a fresh upload for every run.	Monthly	Weekly or monthly	Daily, weekly or monthly
Assessments running at once	1 per domain, up to 3	3	10
Pivot scans to related domains	Not included	Each counts toward your 5 domains	Included
Findings and reports
Live console, benign proof, CVSS, CWE and remediation	Included	Included	Included
Triage, trends, run comparison and asset inventory	Included	Included	Included
Live NVD CVE and EPSS context	Included	Included	Included
Attack paths and identity graph for tenants	Not included	Add-on: with a tenant	Included
Portfolio dashboard and report	Not included	Included	Included
Report templates	2	5	All 8
Formats	HTML, JSON and PDF	HTML, JSON, PDF and CSV	HTML, JSON, PDF and CSV
Your logo and colours on reports	Not included	Included	Included
SBOM for each repository: CycloneDX or SPDX	Not included	Included	Included
Compliance
OWASP Top 10 and MITRE ATT&CK v15.1	Included	Included	Included
NIST CSF 2.0, SP 800-53, SP 800-171 and COBIT	Not included	Included	Included
CIS AWS, Azure and GCP	Not included	Included	Included
CIS and CISA SCuBA for Microsoft 365 and Google Workspace	Not included	Add-on: 1 pair, with a tenant	All four
OWASP MASVS for Android apps	Add-on: with an app	Included	Included
OpenSSF Scorecard for repositories	Not included	Included	Included
Compliance workspace: owners, notes and evidence	View only	250 MB of evidence	Included
Access and support
UsersMore than one user needs team workspaces, which AQIRA does not have yet: until then, each plan has one named login.	1	Up to 10	Unlimited
SSO with your identity provider	Not included	Not included	On a dedicated deployment
Dedicated deployment	Not included	Not included	Included
SupportIn Pakistan business hours, Monday to Friday.	Email, within 2 business days	Next business day, with onboarding	A named contact and an SLA
AQSEC expert days	Add-on	Add-on	4 a year
Emergency runs	Add-on	Add-on	2 a quarter

Included
Not included
Add-on

Add-ons

More targets, more assessments or AQSEC's own time, on the plans that offer them. Prices follow the currency you chose above.

Add-on	Available on	Price
Android appUp to 12 uploads a year, each with a retest upload. Standard intensity on Standard; Deep on Premium and Enterprise.	Standard (1 app), Premium and Enterprise	USD 1,990AED 5,900PKR 119,000per app, a year
Single Android assessment1 upload and 1 retest upload.	Every plan	USD 990AED 2,900PKR 59,000one-off
Extra domainAdds 1 assessment a month to your pool.	Premium and Enterprise	USD 1,490AED 4,400PKR 89,000per domain, a year
Code repositoryAdds 1 assessment a month to your pool.	Premium and Enterprise	USD 990AED 2,900PKR 59,000per repository, a year
Cloud accountAWS, Azure or GCP, with its CIS benchmark. Adds 1 assessment a month.	Premium (up to 5 accounts in all) and Enterprise	USD 1,490AED 4,400PKR 89,000per account, a year
Microsoft 365 or Google Workspace tenantWith its CIS and CISA SCuBA benchmarks and the identity graph. Adds 1 assessment a month.	Premium (1 tenant) and Enterprise	USD 2,990AED 8,900PKR 179,000per tenant, a year
Assessment pack10 more assessments, up to 2 Deep, each with its retest, used within 90 days.	Premium and Enterprise	USD 490AED 1,450PKR 29,000per pack of 10
Emergency runStarts within 4 business hours, Pakistan time, with an AQSEC triage note within 1 business day.	Every plan; Enterprise includes 2 a quarter	USD 490AED 1,190PKR 19,900per run
AQSEC expert dayManual confirmation of High and Critical findings, a verified retest with a signed note, or manual checks. Sold in half days.	Every plan; Enterprise includes 4 a year	USD 1,400AED 3,200PKR 55,000per day

Enterprise

Every input as one programme, on your own deployment

Enterprise starts at the price shown and is quoted for your scope.

SSO with your identity provider, on a dedicated deployment
20 domains, 10 Android apps, 20 repositories, 5 cloud accounts and 2 tenants, with more by quote
Every intensity, with daily schedules across the estate
A named AQSEC contact, an SLA, 4 expert days a year and 2 emergency runs a quarter

Talk to sales about EnterpriseTalk to sales about Enterprise

How billing works

Five things to know before you choose a plan.

Monthly or yearly: Monthly is billed each month, on a 12-month term. Yearly is billed upfront at the price of 10 months: 2 months free.
Taxes: All prices exclude VAT and other taxes.
Regional pricing: AED prices are for organisations invoiced in the Gulf, and PKR prices for organisations invoiced in Pakistan; PKR plans have smaller assessment pools. Everywhere else, prices are in USD.
Enterprise: The price shown is the floor. We quote Enterprise from it, for your targets, deployment and support.
Allowances: A domain covers its subdomains and APIs, up to about 25 live hosts under fair use. Monthly allowances reset on your billing date and do not roll over.

Ask sales through the contact form, or write to hello@aqsec.co.

The access each input asks for, and what AQIRA keeps, is on the security page.

Pricing questions

For anything else, write to hello@aqsec.co.

What counts as a domain?

One domain, such as example.com, with the subdomains and APIs AQIRA finds under it, up to about 25 live hosts under fair use. A Standard plan is tied to its domain; you can swap it for another once a quarter.

What is an assessment, and what is a retest?

An assessment is one run of the six agents against one target. A retest runs the same checks against your fixes, within 30 days. Reconnaissance, which maps the attack surface without sending attacks, does not count against your allowance, up to once a day per target.

Can Standard test an Android app?

Yes: add one Android app for the year, or buy a single Android assessment. An app needs a fresh upload for every run, so it cannot run on a schedule. Premium includes 2 apps and Enterprise 10.

How many people can use a plan?

Standard has 1 user, Premium up to 10 and Enterprise unlimited. More than one user needs team workspaces, which AQIRA does not have yet: until then, each plan has one named login.

What do we need before an assessment runs?

Permission. Test only what you own or have written permission to test: every active assessment asks the operator to confirm they are authorised for the target.

Who runs the assessments?

Your team, in the console. AQSEC agrees the scope with you when a plan starts, and its consultants join through expert days: included in Enterprise, an add-on on the other plans.

Next step

Talk to sales about a plan

We reply by email with a time for a call, and set out the plan for your targets.

Book a demo Talk to sales