Start with the surfaces and workflows
A URL count is a starting point, but it does not describe all the work. A product with one domain can contain several roles, administrative workflows, and tenant boundaries. An Android app may also need a separately scoped API review. List the important flows and access levels before asking for a price.
- Web applications: domains, authenticated areas, roles, and tenant boundaries.
- Android applications: app builds, local data, platform interactions, and backend access.
- APIs: endpoint groups, authentication methods, object ownership, and integrations.
Agree on testing depth and access
Ask what the engagement includes beyond automated scanning. Manual authorization testing, investigation of business logic, and validation of findings all affect the work involved. Source-assisted review can also change the approach. The quote should describe the method and expected access rather than relying on the word pentest alone.
Good preparation reduces time lost to blocked accounts or missing data. Provide representative roles, a stable testing environment, and a walkthrough of the workflows you care about. Limited access can reduce coverage even when the testing window is unchanged.
Compare the report and retest terms
A list of scanner alerts is different from a report with validated findings, reproduction steps, prerequisites, impact, and remediation guidance. Agree on the report's audience and any customer requirements before testing starts.
A retest checks whether the reported issue has been addressed in a changed build or environment. Confirm whether it is included, its time window, the number of fixes it covers, and how the result will be documented. Do not assume those terms are identical across quotes.
What to send when requesting a quote
A concise scope brief helps a testing partner give you a meaningful proposal. You do not need to share credentials in the first email; describe the access you can provide and agree on a secure handover later.
- What the product does and which Android, web, or API surfaces need testing.
- The roles, tenants, and sensitive workflows you want covered.
- Available documentation, source access, and testing environments.
- Your target dates and any release or customer-review deadline.
- Required report deliverables and whether you want remediation retesting.
Choose a scope you can compare
Ask each provider to quote against the same application inventory, access assumptions, testing objectives, and deliverables. A lower price may reflect a narrower scope or less validation; a higher price does not by itself prove better coverage. Read the assumptions and exclusions.
Wisp Security offers custom quotes for Android, web application, and API security testing for teams in India. Share your scope and we can discuss the testing work and deliverables that fit the decision you need to make.