// section 4 · 150 items
Penetration testing, audit, compliance, protection
Security review, penetration testing, compliance and turnkey protection. inreallab prices are 10–25% below specialist security boutiques thanks to the full-cycle model (development + security in one team). Engagement model: grey box by default (black box −0–10%, white box +15–30%).
4.1
Penetration testing
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Web application penetration test | $2,300 – $7,500 | |
| External penetration test (perimeter) | $3,200 – $8,800 | |
| Internal penetration test | $3,800 – $11,500 | |
| Mobile application penetration test | $2,800 – $6,900 | |
| API security assessment | $1,900 – $5,700 | |
| Social engineering (phishing/vishing) | $1,900 – $5,000 | |
| Wi-Fi penetration test | $1,500 – $3,800 | |
| Red Team (limited scenario) | from $19,000 | |
| Red Team (APT simulation) | $31,500 – $100,000 | |
| LLM/AI service security audit | scoped from $2,500 / full from $12,500 | |
| Comprehensive "all-in-one" penetration test | $11,500 – $31,500 |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Retest / verification of remediation | from $320 | |
| Tool-based vulnerability assessment (scan + manual validation, no deep exploitation) | from $600 | |
| Express penetration test of a website / landing page / small web application | from $600 | |
| ICS/SCADA penetration test (industrial systems) | from $5,700 | |
| Penetration test of critical information infrastructure (CII) facilities (under 187-FZ, Russian critical infrastructure law, for significant facilities) | from $4,400 | |
| Cyber test for banks/financial institutions (Central Bank regulations 683-P/802-P, GOST 57580.1 — GOST is the Russian state standard) — annual | from $5,700 | |
| Penetration test of remote banking / mobile and internet banking / payment gateway | from $4,800 | |
| Smart contract / Web3 / blockchain security audit | from $3,800 | |
| Active Directory penetration test (standalone vector: domain takeover, Kerberos attacks) | from $1,900 | |
| Kubernetes / container infrastructure penetration test (Docker, registries, escape) | from $2,300 | |
| Thick client / desktop application penetration test | from $1,900 | |
| Non-standard API penetration test (GraphQL / gRPC / SOAP / WebSocket) | from $1,500 | |
| Stress / DDoS testing (resilience under load) | from $1,200 | |
| Physical penetration test (entry to the site, bypassing access control, tailgating) | from $2,300 | |
| Purple Team (joint attack exercises with the SOC/blue team, detection tuning) | from $6,300 | |
| OSINT reconnaissance / analysis of the company's digital footprint (separate from a penetration test) | from $900 | |
| Bug Bounty programme setup and ongoing support (launch, scope, report triage) | setup from $1,500 + from $900/month | |
| Continuous penetration testing / PTaaS (pentest as a service, retainer) | from $1,200/month | |
| PCI DSS penetration test (segmentation + application/network penetration test) | from $2,800 |
"Penetration testing" breakdown — individual sub-services:
4.2
Security review and audit
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Application security review | $1,500 – $4,400 | |
| Express OWASP Top-10 | $900 – $1,900 | |
| Code audit (SAST + manual) | from $20 /hour or $1,900 – $8,800 | |
| Infrastructure audit | $1,900 – $6,300 | |
| Cloud audit (Yandex/VK/K8s) | $1,900 – $5,000 | |
| Threat modelling (STRIDE) | $1,300 – $3,800 | |
| DevSecOps implementation (SAST/DAST/SCA in CI/CD) | audit from $900 / implementation from $2,500 / ongoing support from $1,200/month |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Active Directory security audit (hardening, BloodHound) | from $1,900 | |
| Database security audit (PostgreSQL/MSSQL/MySQL — hardening, privileges, encryption) | from $750 | |
| Server hardening to the CIS Benchmark (per host) | from $190 | |
| CMS security audit (1C-Bitrix / WordPress) | from $250 | |
| Logging and detection readiness audit (SIEM readiness) | from $1,000 | |
| Compromise assessment (check for signs of compromise) | from $1,900 | |
| Security code review as a service (embedded in sprints, PR review) | from $20 /hour / from $1,200/month |
"Security review and audit" breakdown — individual sub-services:
4.3
Compliance
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| 152-FZ (Russian data-protection law) audit + document pack | $1,200 – $4,400 | |
| Personal data document pack only | $440 – $1,200 | |
| Bringing the business into compliance with 152-FZ | $2,500 – $11,500 | |
| GDPR | $1,900 – $6,300 | |
| 187-FZ / CII, GOST 57580 | from $3,800 | |
| Connection to GosSOPKA, the state cyberattack detection system (CII) | from $2,500 + from $500/month (indicative, final figure after review) | |
| ⭐ Software vulnerability analysis to EAL4 (GOST 15408) | analysis from $5,700 / turnkey from $10,000 / repeat from $1,500 | |
| PCI DSS — preparation / QSA support | preparation from $4,400 / QSA support from $10,000 | |
| Certification of state information systems / personal data systems (FSTEC — the Russian technical regulator, orders 17/21) | from $3,200 |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Personal data processing notification to the regulator (Roskomnadzor) (filing / update) | from $90 | |
| Information security / personal data threat model (FSTEC 2021 methodology) | from $500 | |
| Determining the protection level of a personal data system (classification report) | from $190 | |
| Assessment of the effectiveness of personal data protection measures (mandatory every 3 years) | from $500 | |
| Assessment of harm to data subjects (mandatory document since 2023) | from $130 | |
| Cross-border personal data transfer notification + justification | from $250 | |
| Personal data consent forms, cookie banner and consent forms on the website | from $150 | |
| Outsourced DPO / personal data support on a monthly retainer | from $320/month | |
| Staff training and briefing on personal data processing | from $250 | |
| Categorisation of a single CII facility (per facility) | from $500 | |
| Inventory and compilation of the list of CII facilities | from $750 | |
| Threat model for a significant CII facility | from $750 | |
| Design of the security system for a significant CII facility (order 239) | from $4,400 | |
| GOST 57580 conformity assessment (external audit for banks and non-bank financial institutions) | from $5,000 | |
| PCI DSS ASV scanning (quarterly, accredited ASV) | from $500/year | |
| PCI DSS gap analysis (diagnostics without full preparation) | from $1,500 | |
| Repeat / periodic FSTEC certification (certificate renewal) | from $1,300 | |
| Certification of a single standalone workstation | from $500 | |
| Compliance audit against Presidential Decree No. 250 (security officer, powers) | from $750 | |
| DPIA — data protection impact assessment (GDPR, standalone) | from $1,200 | |
| Appointment of an EU representative under GDPR | from $1,200/year | |
| Set of internal security regulations (security policy, procedures — not personal data) | from $650 |
"Compliance" breakdown — individual sub-services:
4.4
Protection and operations
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| WAF setup | $1,300 – $3,800 + from $250/month | |
| DDoS protection | $500 – $1,500 + subscription | |
| Hardening (remediation of findings) | from $20 /hour or $1,300 – $5,000 | |
| Incident response (IR) | from $1,900 / from $65 /hour | |
| IR retainer (subscription) | from $750/month | |
| Monitoring / SOC-lite | from $650/month | |
| Vulnerability Management | from $380/month |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Audit and tuning of an existing WAF (without deployment from scratch) | from $750 | |
| Virtual patching / custom WAF rules | from $380 | |
| API protection (WAAP) — setup | from $1,300 | |
| Anti-bot protection (bot management) | from $650 + subscription | |
| DDoS resilience stress test (load testing) | from $500 | |
| Rate-limit / geo-filtering setup without a provider subscription | from $250 | |
| Server/OS hardening to the CIS Benchmark (per host) | from $150/host | |
| Docker / Kubernetes hardening | from $1,000 | |
| Web server hardening + TLS / security headers / CSP | from $250 | |
| Active Directory / domain infrastructure hardening | from $1,300 | |
| Computer forensics / DFIR (per drive image) | from $650/drive | |
| Compromise Assessment (check for hidden compromise) | from $2,500 | |
| Ransomware recovery | from $2,500 | |
| Threat Hunting (one-off engagement/sprint) | from $1,900 | |
| Malware reverse engineering (per sample) | from $650/sample | |
| SIEM implementation (KUMA / MaxPatrol SIEM / equivalent) | from $5,000 + licences | |
| Connecting a source to SIEM/SOC (per source) | from $65/source | |
| EDR/XDR implementation and setup | from $1,900 + licences | |
| Centralised log collection setup (ELK / syslog / Graylog) | from $1,000 | |
| One-off infrastructure vulnerability scan (network scan) | from $380 | |
| Vulnerability Management system implementation (MaxPatrol VM / RedCheck) | from $3,800 + licences | |
| Patch management / update management (retainer) | from $500/month |
"Protection and operations" breakdown — individual sub-services:
4.5
Training, bug bounty, ongoing support
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Secure development training (SSDLC) | $1,000 – $3,200 | |
| Security Awareness (anti-phishing) | $650 – $2,500 | |
| Bug bounty launch/support | from $750 + from $380/month | |
| Retest (remediation verification) | 20% of the project (min. $500) | |
| vCISO / security consulting (subscription) | from $1,300/month |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| System threat modelling + workshop for the team | from $1,200 | |
| Threat model produced to the FSTEC methodology (document) | from $750 | |
| DevSecOps pipeline implementation (SAST/DAST/SCA in CI/CD) | from $2,500 + from $250/month | |
| Development process maturity audit (SSDLC assessment, gap analysis) | from $1,700 | |
| One-off simulated phishing campaign (without an annual platform) | from $380 | |
| Security Awareness — platform subscription (per employee per year) | from 250/employee/year | |
| Social engineering test (phishing + vishing + physical access), offensive | from $1,200 | |
| Tabletop cyber exercise (rehearsing incident response) | from $1,900 | |
| Cyber range / CTF training for development and DevOps teams | from $1,300 | |
| Development of a set of security policies and procedures | from $1,200 | |
| Security maturity assessment / gap analysis against a framework (ISO 27001, NIST) | from $1,500 | |
| Responsible Disclosure / VDP programme setup (without a bounty fund) | from $500 | |
| Bug bounty report triage — paid per report (instead of a retainer) | from $40/report | |
| Validation/analysis of an individual vulnerability report (third-party researcher) | from $65 | |
| One-off strategic vCISO security session (without a subscription) | from $500 | |
| ISMS implementation / preparation for ISO/IEC 27001 certification (consulting) | from $3,200 | |
| Staff training on personal data protection (152-FZ) | from $380 | |
| Mentoring/ongoing support for the client's security specialist (retainer) | from $650/month |
"Training and bug bounty" breakdown — individual sub-services:
4.6
The Russian software registry, IT accreditation, tax incentives
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Turnkey listing of software in the Russian software registry (Ministry of Digital Development) | from $1,200 | |
| IT company accreditation with the Ministry of Digital Development | from $600 | |
| Bundle "software registry + accreditation + tax incentives" | from $1,700 | |
| Audit of software readiness for the registry | from $320 (after a free review) | |
| Listing a hardware-software system in the registry | from $2,800 | |
| Software registration certificate (Rospatent) | from $250 + state fee |
Breakdown — individual sub-services
| Service | Russian market, $ | inreallab, $ |
|---|---|---|
| Preparation of the technical/operational documentation set for the registry (GOST 19/34: application description, user and administrator manuals) | from $380 | |
| Re-filing the registry application after a refusal (addressing the expert council's comments + a new document set) | from $440 | |
| Responses to the expert council's comments / support at the hearing | from $250 | |
| Amendments to the registry entry for listed software (updating details, version, company data, class) | from $190 | |
| Assigning/justifying the software class under the classifier (choice of code, rationale) | from $130 | |
| Listing software in the unified Eurasian software registry (EAEU) | from $1,200 | |
| Database registration certificate (Rospatent, state registration of a database) | from $250 + state fee | |
| Deposit of source code / of a work (copyright, storage of the deposit) | from $65 | |
| Trademark registration (brand/software name, Rospatent) | from $380 + state fees | |
| Annual confirmation of IT company accreditation (yearly procedure by 1 June: check of revenue share, salaries, business activity codes) | from $250 | |
| Preparation for accreditation: website setup (correct business activity code, publication of company activity details), consent to disclose tax secrecy | from $190 | |
| Reinstatement of accreditation after removal from the Ministry of Digital Development register | from $500 | |
| Obtaining and maintaining IT tax incentives (profit tax, social contributions at 7.6%): calculating the ≥70% qualifying revenue share, document handling | from $500 / from $250/month | |
| Preparation of an application for an RFRIT grant / subsidy for developing and deploying Russian software | from $1,300 | |
| Listing products in the Russian electronics registry (Ministry of Industry and Trade, Government Decree 719) for hardware-software systems/equipment | from $2,300 | |
| Assessment of software against the registry requirements (check of ≥50% Russian ownership, absence of forced foreign updates, licence cleanliness) | from $380 | |
| Ongoing support of registry status on a monthly retainer (monitoring requirements, timely amendments, renewals) | from $190/month |
Turnkey packages: Start. Express security — from $1,500 (OWASP + 152-FZ documents); Business. Secure release — from $5,700 (review + web penetration test + API + retest); Compliance pack — from $2,500; Defence. Annual support — from $1,200/month; Enterprise. Red Team + protection — from $37,500/project + subscription.
"Software registry" breakdown — individual sub-services:
Sources: [Awillix — penetration test calculator](https://pricing.awillix.ru), [RTM Group](https://rtmtech.ru/services/site-pentest/), [Anti-Malware](https://www.anti-malware.ru/analytics/Market_Analysis/Pentest-pricing), [Astral Security](https://is.astral.ru/services/kiberbezopasnost/pentest/), [RTM — 152-FZ audit](https://rtmtech.ru/services/audit-152-fz/), [Solar — IR retainer](https://rt-solar.ru/services/jsoc/incident_response_retainer/architecture/).
Every price is a starting point. The final quote is fixed after a free breakdown of the task: scope, timeline and stages are costed for your project. Figures are converted from rubles at a fixed rate; invoices are issued in rubles.
Full price list PDFNeed a number for your task?
We'll cost it precisely.
Describe the task — we come back with an estimate and a timeline. No obligation.