Our pricing plans are based on how large and complex the target cluster is.
Small clusters, upto 3 nodes and 4 services.
Medium clusters upto 10 nodes and 20 services.
Custom pricing for dynamic number of nodes and services
One time VAPT For teams that need quick results.
TAT: 7-10 days
Ideal For Businesses With Multiple Apps.
Ideal For Enterprises with on-going requirements
Gartner predicts that "By 2025, 60% of organizations will use cybersecurity risk as a primary determinant in conducting third-party transactions and business engagements ".
Whether you're B2B or B2C or B2B2C, your customer expects a advanced security posture from you. Appsecco understands this.
"Appsecco helped us with actionable insights on the security posture of our AWS cloud platform and business applications. As a result, our developers fixed critical weaknesses and are more aware of what to keep in mind while building applications and using infrastructure as we grow."
Pentest as a Service, or PTaaS, is a SaaS delivery model for engaging and executing Penetration Tests of apps, networks and systems as an ongoing service rather than a one-time periodic event. For a pentest delivery model to be called a service it has to be easy to onboard, easy to buy and easy to infer the outcome of the pentest.
Appsecco's PTaaS makes it very easy to onboard (fill a form to collect cluster information), buy (Stripe or bank transfer) and infer (easy to understand reports in various formats).
Post assessment support is available as part of the service where Appsecco's team provide assist with any questions, additional guidance, documentation and clarifications.
PTaaS allows customers to buy a penetration test for a defined scoped target, based on a set of qualifiers like how large the target is, what kind of access is available, is the target on prem or hosted on the cloud, how frequently the pentest needs to be run etc. The payment is done via an online payment method or bank transfer which essentially confirms and initiates the allocation of time of our resources.
Our Kubernetes PTaaS pre-requisite form collects information about the cluster which allows the team to commence the execution of the pentest. Once the assessment is over (typically between 6-10 days), our comprehensive report is shared over a secure channel and a report readout call is scheduled to discuss the findings (optional).
Absolutely! We would love to provide our assessment capabilities as a one time service and help you evaluate the results so that you can make an informed choice to buy additional penetration tests over the year. Get in touch with us to get started!
Depends on the cluster size. Typical time it takes ranges from 4 days to get report after we begin to up to 12 days for larger clusters
Our pricing is straightforward and is based on cluster size, which is a combination of number of nodes and services (ClusterIP, LoadBalancer, NodePort etc.). In any case, we require you to share some non sensitive information about the target cluster so that we can send you the actual price for the pentest (which often is lower than the prices listed on site!)
Our assessment team would love to take a look at any previous findings you may have, eliminate any false positives and tell you if they are valid or of any consequence to security. Unfortunately, assessment vendors often inflate severity ratings for findings which can cause your team to get tied up fixing inconsequential bugs. Our team can review these findings for you as part of the PTaaS engagement.
No. As part of the PTaaS and our teams ability, we create a comprehensive assessment report that provides detailed mitigation and solutions in developer friendly language along with code snippets and configurations where applicable. We will also run the developer and infra teams through the report via a report readout call to answer any questions they may have.
Support will also be extended to the devs after the assessment is over to ensure fixes are being done properly. However, Appsecco will not perform any patches, fixes, configuration changes or upgrades themselves on your environment.
The team running the Kubernetes PTaaS is led by Riyaz Walikar, a well known industry veteran who has over 15 years of experience hacking everything from ships to web and mobile apps, on-prem and wireless networks, cloud infrastructure, containers, Kubernetes, thick clients and security appliances. He and his team have found hundreds of critical vulnerabilities across products in various industries, many of them 0 days.
The team has numerous certifications, some of which include CKA, CKAD, AWS Security Specialty, CREST and OSCP. The team members frequently speak and train at security conferences like BlackHat, DEFCON, nullcon, BSides etc. and write a lot of technical content on our blog that is reused by the security community and industry in general.