Pricing
Security work has been priced for funded enterprises for years, which is why most teams put it off until a deal is already stalling. Fixed scope, fixed price, published in the open, and an entry point that a team still building its MVP can afford.
innsecs provides services, not certificates. We build your management system, run the testing and prepare you for audit. The certificate itself is issued by an accredited certification body, and a SOC 2 report by a licensed CPA firm, both of which must stay independent of whoever implemented your controls. We help you choose and engage them.
For MVPs and pre-seed teams.
You're shipping fast and someone just asked a security question you can't answer.
Audit-ready on one framework.
A deal is blocked on ISO 27001 or SOC 2 and you need it done properly.
Audit-ready, and proof it means something.
One team runs certification and testing, so the pentest feeds your evidence.
Keep it true after you're certified.
You're certified and need it to stay that way without hiring a team.
Figures are starting points for a typical SaaS engagement and exclude the certification body’s own audit fees, which are paid directly to them and never marked up by us. Your exact price depends on headcount, environments and starting maturity, the scoping call and written proposal cost nothing.
How this compares
Not because the work is lighter, but because we don't carry a sales team, an office or a bench of juniors to keep busy. Market figures below are 2026 published ranges.
| Engagement | Typical market | innsecs |
|---|---|---|
| ISO 27001, consultant-led | $15,000 – $30,000 | from $9,500 |
| Startup web app pentest | $5,000 – $15,000 | from $4,500 |
| Cloud security assessment | $7,000 – $15,000 | from $3,500 |
| Compliance platform + advisory | $7,500 – $15,000 / yr | from $14,400 / yr |
Market ranges are published 2026 figures for consultant-led ISO 27001 implementation, scoped startup web application penetration testing, and compliance platform plus advisory bundles. Certification body audit fees are excluded from both columns.
Compare in detail
No asterisks, no 'contact us for details'. If it isn't in this table, it isn't in the price.
| What’s included | Launch Review | Certification Readiness | Audit-Ready & Secure | Continuous Assurance |
|---|---|---|---|---|
| Certification | ||||
| Gap analysis against ISO 27001:2022 or SOC 2 | light | Included | Included | annual |
| ISMS scope and Statement of Applicability | Not included | Included | Included | maintained |
| Risk methodology, register and treatment plan | Not included | Included | Included | maintained |
| Full policy and procedure set, fitted to you | Not included | Included | Included | maintained |
| Evidence pack mapped control-by-control | Not included | Included | Included | Included |
| Internal audit and management review | Not included | Included | Included | annual |
| Certification body selection and liaison | Not included | Included | Included | Included |
| Stage 1 and Stage 2 audit support | Not included | Included | Included | surveillance |
| Security testing | ||||
| Application and cloud security review | Included | Included | Included | Included |
| Prioritised remediation list for your engineers | Included | Included | Included | Included |
| Manual web and API penetration testing | Not included | Not included | Included | recurring |
| Multi-tenancy and authorization boundary testing | Not included | Not included | Included | recurring |
| Cloud security assessment across all supported platforms | light | Not included | Included | annual |
| Threat model feeding your risk register | Not included | Not included | Included | Included |
| Free retest of every finding | Not included | Not included | Included | Included |
| Customer-shareable attestation letter | Not included | Not included | Included | Included |
| Ongoing support | ||||
| Named senior security lead | Not included | during engagement | during engagement | Included |
| Shared Slack or Teams channel | Included | Included | Included | Included |
| Customer security questionnaires and CAIQ / SIG | one | Not included | Not included | Included |
| Enterprise prospect security calls attended | Not included | Not included | Not included | Included |
| Incident response plan and tabletop exercises | Not included | Not included | Not included | Included |
| Quarterly board-level reporting | Not included | Not included | Not included | Included |
Standalone
Both are available on their own, and both credit against a certification programme if you start one within six months.
What you're actually choosing between
All three get sold into the same problem. They solve genuinely different parts of it, and the honest comparison is below.
| Capability | innsecs | Compliance platform | Large audit firm |
|---|---|---|---|
| Scopes your ISMS and writes the Statement of Applicability | Yes | No | Yes |
| Runs a defensible risk assessment on your actual architecture | Yes | Partial | Yes |
| Policies written for your business, not templates | Yes | No | Partial |
| Manual penetration testing included in the same engagement | Yes | No | No |
| Findings retested and verified closed, at no extra cost | Yes | No | No |
| Named senior consultant for the whole engagement | Yes | No | No |
| Reads your Terraform and reviews your pull requests | Yes | No | No |
| Continuous evidence collection and drift monitoring | Partial | Yes | No |
| Fixed price, held for the engagement | Yes | Yes | No |
| Can issue your certificate | No | No | No |
Scopes your ISMS and writes the Statement of Applicability
Runs a defensible risk assessment on your actual architecture
Policies written for your business, not templates
Manual penetration testing included in the same engagement
Findings retested and verified closed, at no extra cost
Named senior consultant for the whole engagement
Reads your Terraform and reviews your pull requests
Continuous evidence collection and drift monitoring
Fixed price, held for the engagement
Can issue your certificate
The last row is not a typo. No consultancy, platform or audit firm can issue your ISO 27001 certificate, only an accredited certification body can, and it must be independent of whoever built your controls. Anyone claiming otherwise is misrepresenting how the standard works.
Our commitments
The figure in your proposal is the figure you pay. Anything genuinely outside scope gets quoted separately, never invoiced quietly.
Every finding is retested and the report reissued with verified fix status. A finding isn't closed because it was reported.
If certification is premature for your stage, or your timeline isn't achievable, we say so before the contract, not after Stage 1.
You get the consultant you scoped with. No junior handoff after kickoff, no rotating bench mid-engagement.
Questions
There isn't one, but there is a reason. Consultant-led ISO 27001 typically runs $15,000–$30,000 and a startup pentest $5,000–$15,000, because those firms carry sales teams, account managers, offices and a bench of juniors. We carry none of that. The consultant who scopes your engagement is the one who does the work, and the saving goes to you rather than into a funnel.
The Launch Review is, and probably nothing else yet. For $1,500 we review your app and cloud, hand your engineers a prioritised fix list, and answer the first security questionnaire that lands. Certification at that stage is usually premature and we will say so. It credits in full against a certification programme later, so nothing is wasted.
Headcount, number of environments, product complexity, how many frameworks you're pursuing, and your starting maturity. A 15-person single-product SaaS on one AWS account sits at the bottom of the range. A 200-person company with three products, four environments and an acquisition to integrate does not.
Yes. We quote a defined scope for a defined figure and we hold it. If something genuinely outside that scope emerges, we tell you and quote it separately rather than quietly expanding the engagement and invoicing later.
Those are separate and paid directly to them. We never mark them up. Budget roughly $8,000–$25,000 for a first ISO 27001 certification depending on your size and the body you choose, plus $4,000–$10,000 a year for surveillance audits. We'll help you get comparable quotes, and for a small team the lower end is realistic.
Engagements are billed in three milestones rather than up front, and retainers are monthly. If cash flow is the blocker rather than the price, say so on the call. We would rather structure it than lose the work.
Tell us your headcount, environments and what's being asked of you. You'll have a fixed-price proposal within three working days.
No sales sequence. A scoping call and a written proposal cost nothing.