Published, in full
What vulnerability scanning costs
Three monthly service levels that scale with how many scanners feed our vulnerability management system, plus the VAPT bundle and the PCI ASV add-on, all published here. You keep your scanners and their licences; the figures cover the management and prioritisation around them, and your exact quote is confirmed at scoping.
Managed scanning
Three levels of service
Essential
One scanner, reporting monthly
£1,890
per month, ex VAT
- One scanner's output ingested into our vulnerability management system
- Your scanners managed end-to-end by our team
- Every vulnerability analysed by a qualified security consultant
- Vulnerabilities prioritised off actual risk to the business using contextual data, not just CVSS score
- Prioritised list of what to fix first
Most booked
Managed
One to five scanners, reporting monthly
£2,870
per month, ex VAT
- Everything included from Essential
- Up to five scanners rolled into one prioritised view
- Scans scheduled and run by us on your tooling
- Scanner configuration kept healthy and coverage complete
- Business-value assessment weighs findings against which systems need most protection
- Remediation guidance calls, findings tracked until closed
Complex
Five plus scanners, continuous monitoring
From £3,450
per month, ex VAT
- Everything included from Managed
- Continuous ingestion across your whole scanner estate
- Multi-entity estates rolled into one prioritised view
- Reporting shaped to your governance cycle
- Fortnightly, monthly and quarterly reviews with your consultant
The VAPT bundle
Assessment plus CREST Pen Testing
A one-off assessment plus CyPro's CREST testing
£8,760
ex VAT
A one-off vulnerability assessment (£2,760) paired with a penetration test delivered by CyPro's CREST-accredited team (£6,000), scoped together and confirmed in one quote. How the VAPT bundle works.
Compliance add-on
PCI ASV Scans
Four quarterly cycles plus one rescan cycle
£670
per month, ex VAT
Run through a PCI-SSC Approved Scanning Vendor partner and managed end to end, from perimeter scoping to attestation evidence. How the ASV cycle runs.
Assumptions, stated plainly
Fees exclude VAT. The published figures are our standard rates and a reliable guide to what you will pay; your exact quote is confirmed at scoping. Your scanner licence is paid by you to your vendor and never appears on our invoice. Onboarding, scanner connection and report setup are included in our service.
For comparison
Three ways to buy scanning, side by side
This market splits into self-serve platforms and quote-only consultancies. The platforms leave the interpretation to you, and the consultancies engage once a year and then leave. Managed Vulnerability Scanning gives you the strengths of both, continuous tooling with a consultant reading every result, and the table shows the differences.
| Self-serve scanning platform | Quote-only consultancy | Managed Vulnerability Scanning | |
|---|---|---|---|
| Pricing | Hidden behind trials; base fee plus per-target arithmetic you assemble yourself | Quoted after a call, typically from day rates above £1,000 | Monthly service levels, published on this page |
| Who reads the results | You do; the export is yours to interpret | A consultant, for the duration of the engagement | A consultant, every scan, all year |
| Cadence | Continuous but unattended | Annual or one-off, then a gap until next year | Monthly to continuous, by service level |
| False positives | Yours to filter | Filtered while the engagement lasts | Removed before the report reaches you |
| Compliance evidence | Raw exports you assemble at audit time | A report per engagement | A dated monthly trail, plus the managed ASV cycle |
Asked about the fees
Pricing, explained further
Why publish prices in a market that quotes?
Because scanning is a repeatable service with a knowable cost, and hiding the figure mostly serves the seller. The platforms gate their pricing behind trials and the consultancies quote only after a call; we publish our service levels so you can compare, the same publish-the-price stance CyPro takes across its specialist services. Your exact quote is still confirmed at scoping.
Which service level fits us?
Count your scanners. One scanner producing monthly reports is Essential. Up to five scanners feeding one prioritised view is Managed. More than five, or estates that need continuous monitoring rather than a monthly cycle, is Complex. The scoping call confirms it, and the scanner licences stay yours at every level.
Do we need to buy a scanner?
You keep and pay for your own scanning tool, whether that is Nessus, Tenable, Qualys or another: the licence is never ours and you are never locked to us through tooling. If you do not have a scanner yet, we advise on the right fit for your estate at scoping, you license it, and we run it from there.
Is internal or external scanning covered?
The service is primarily about internal scanning, because that is where the volume, the noise and the hard prioritisation decisions live. External scanning is included whenever you want it: if your scanner covers your internet-facing estate, those findings flow into the same prioritised view at no extra cost.
How does the PCI ASV add-on work?
It is priced at £670 per month and covers the four quarterly ASV scan cycles a year that PCI DSS requires, including one rescan cycle after failures. The scans run through a PCI-SSC Approved Scanning Vendor partner; we scope the perimeter, interpret the results, drive the fixes and hand you the attestation evidence.
When does Complex become a quote?
When the estate genuinely stops fitting a published service level: several scanners feeding one view, multiple subsidiaries, or contractual reporting obligations that reshape the service. The quote is built from the same arithmetic as the published figures, so you can check our workings against this page.
Prices published, scope confirmed on a call
Match a service level to your estate in one call
One short call counts what you actually expose, agrees the service level that fits and confirms your quote against the figures published above, then books the first scan.