BreachLock pricing: tiers with no published prices

BreachLock pricing is quote-only. The pricing page describes three tiers and shows no dollar figures, as checked on 9 November 2026. This page records what the tiers state, what drives a quote and what to ask.

What is BreachLock pricing at a glance?#

BreachLock sells human-led pentesting as a service from an in-house team described as expert-led and AI-accelerated. It also sells attack surface discovery and a separate autonomous product, Breach360.

We list no starting price, because the vendor shows none.

What does the price buy?#

The pages give no unit. A buyer cannot tell whether a quote covers one application, one asset or one engagement. The tier names suggest depth, but the pages we checked do not define the depth of each tier in testing hours or test cases.

The scope the vendor names is broad: web apps, APIs, cloud, network and mobile. The dataset records AI application testing as unknown. The services list also names red team, social engineering and IoT testing. A single quote may mix several of these, so ask for a line-by-line scope.

What drives the final cost?#

BreachLock does not say what sets the quote. These are the usual drivers across pentest quotes, and the pentest cost guide explains them.

1. The number of applications, APIs and environments.
2. The number of user roles to test.
3. Testing depth, which maps to the tier you pick.
4. The number of retests, since each tier includes a fixed count.
5. Add-ons such as network, mobile or red team work.

Ask BreachLock which of these it uses, and whether it prices by asset, day or fixed scope.

How does BreachLock compare with providers that publish prices?#

Providers in our dataset split into two groups. Some publish a figure with a unit. Others, like BreachLock, publish tiers and ask for a call. Per-test AI services such as TurboPentest ($99, $299 or $699 per credit), Intruder ($3,500 or $4,000 per test) and Aikido ($4,000 per assessment) list amounts. See TurboPentest pricing and Aikido pricing.

The groups do not sell the same thing. BreachLock describes a human-led team with a free-retest count per tier. The per-test services describe automated runs. A quote from BreachLock and a $4,000 AI test answer different questions, so compare the report, the retest terms, the reviewer and the amount. The AI vs human pentesting guide explains where each approach stops.

If you hold a BreachLock quote, ask for the scope behind each line. A tier name alone does not tell you the number of testing days or the number of applications covered. Request the same written scope from two other providers, and compare the three answers line by line.

What does BreachLock not publish?#

Four items are missing from the pages we checked: any dollar figure, the unit of a quote, a public sample report and a time for test length or report delivery. The 24 to 48 hour claim is the time to scope and start a test. The dataset notes that test length and report delivery are not stated.

Headquarters country is "Not published" in the dataset. The homepage describes BreachLock as a CREST-accredited provider. That is a vendor claim we did not verify. Check the accreditation with CREST before you rely on it.

What are the retest and report terms?#

Retest terms appear in two forms. The tier table gives free manual retests of 1, 2 and a custom number. The PTaaS product text promises unlimited retesting. Both are on the vendor's pages, and they do not match.

If your fixes may take several rounds, put the retest count and its time window in the contract. The compliance frameworks named on the site are PCI DSS, ISO 27001, HIPAA, SOC 2, GDPR, DORA and NIST CSF 2.0. A mention of a framework does not mean an auditor accepts the report, so ask your auditor.

How should you read the 24 to 48 hour claim?#

The homepage says pentests can be scoped and started within 24 to 48 hours. That is a start time. It says nothing about how long testing lasts or when the report arrives. A scoping call, a signed authorization and test-account setup usually come first, and any of them can move the real start date.

Ask for three dates in writing: the kickoff date, the end of testing and the report delivery date. Then compare them with your release or audit deadline. If a deadline is fixed, ask what happens to the schedule if your team is slow to provide access.

Who does it fit, and what are the tradeoffs?#

Our dataset describes the best fit as buyers who want a CREST-accredited in-house human team with audit-ready reports and a defined free-retest count per tier. The tradeoffs are that no price or sample report is public, and the retest allowance is stated two ways.

For options with published prices, see the pricing index and BreachLock alternatives.

What should you ask before you buy?#

1. What is the quote unit: application, asset, day or engagement?
2. What does each tier test, in hours or test cases?
3. How many retests are included, and for how many days?
4. When will the report arrive after testing starts?
5. Can I see a sample report for my scope?
6. Is the testing done by employees or by contractors?

The questions to ask a pentest provider guide extends this list. Send a correction if the vendor page now differs.