Published, in full
What vulnerability scanning costs
Three monthly bands that scale with how many scanners feed our vulnerability management system, plus the PCI ASV add-on, all printed here. You keep your scanners and their licences; the figures below are for the management and prioritisation around them. You should not need a sales conversation to learn a price.
Managed scanning
Three monthly bands, every figure printed, your scanner throughout
Essential
One scanner, reporting monthly
£1,890
per month, ex VAT
- One scanner's output ingested into our vulnerability management system
- Run by your team, or by us on your tooling and licence
- Every finding deduplicated and read by a consultant
- Proprietary risk analysis ranks what to remediate first
- Ranked fix list on a fixed day each month
Most booked
Managed
One to five scanners, reporting monthly
£2,870
per month, ex VAT
- Up to five scanners rolled into one prioritised view
- Scans scheduled and run by us on your tooling where you want them
- Scanner configuration kept healthy and coverage complete
- Business-value assessment weighs findings against what systems are worth
- Remediation guidance calls, findings tracked until closed
Complex
Five plus scanners, continuous monitoring
From £3,450
per month, ex VAT
- Continuous ingestion across your whole scanner estate
- Multi-entity estates rolled into one prioritised view
- Reporting shaped to your governance cycle
- Quarterly review with your consultant
- Priced like for like, so larger scopes stay checkable
The VAPT bundle
Assessment plus CREST Pen Testing
Our managed leg plus CyPro's testing, priced honestly
Band + quote
testing quoted separately by CyPro
Your scanning band from this page covers the assessment leg; the penetration test is scoped and quoted separately by CyPro's CREST-accredited team, so each half of VAPT is priced as what it is. How VAPT unbundles.
Compliance add-on
PCI ASV Scans
Four quarterly cycles plus one rescan cycle
REPLACE_WITH_PRICE_ASV_ADDON
per year, ex VAT
Run through a PCI-SSC Approved Scanning Vendor partner and managed end to end, from perimeter scoping to attestation evidence. How the ASV cycle runs.
Assumptions, stated plainly
Fees exclude VAT. Bands assume the estate agreed at scoping; growth moves you between bands with notice, never retrospectively. Your scanner licence is paid by you to your vendor and never appears on our invoice. Onboarding, scanner connection and report setup are included in the first month. Penetration testing, incident response and monitoring are CyPro services in their own right and are always priced as such.
For comparison
Three ways to buy scanning, side by side
This market splits into self-serve platforms and quote-only consultancies. The platforms publish no usable figures, and one incumbent consultancy's own marketing puts traditional assessments at more than £1,000 a day. The managed service sits between the two, and the table shows what you give up with each.
| Self-serve scanning platform | Quote-only consultancy | Managed Vulnerability Scanning | |
|---|---|---|---|
| Pricing | Hidden behind trials; base fee plus per-target arithmetic you assemble yourself | Quoted after a call, typically from day rates above £1,000 | Monthly bands and fixed fees, printed on this page |
| Who reads the results | You do; the export is yours to interpret | A consultant, for the duration of the engagement | A consultant, every scan, all year |
| Cadence | Continuous but unattended | Annual or one-off, then a gap until next year | Monthly to continuous, by band |
| False positives | Yours to filter | Filtered while the engagement lasts | Removed before the report reaches you |
| Compliance evidence | Raw exports you assemble at audit time | A report per engagement | A dated monthly trail, plus the managed ASV cycle |
Asked about the fees
Pricing, explained further
Why publish prices in a market that quotes?
Because scanning is a productisable service with a knowable cost, and hiding the figure mostly serves the seller. The platforms gate their pricing behind trials and the consultancies quote after a call; we print the bands and let you compare, the same publish-the-price stance CyPro takes across its specialist services.
Which band fits us?
Count your scanners. One scanner producing monthly reports is Essential. Up to five scanners feeding one prioritised view is Managed. More than five, or estates that need continuous monitoring rather than a monthly cycle, is Complex. The scoping call confirms it, and the scanner licences stay yours in every band.
Do we need to buy a scanner?
You keep and pay for your own scanning tool, whether that is Nessus, Tenable, Qualys or another: the licence is never ours and you are never locked to us through tooling. If you do not have a scanner yet, we advise on the right fit for your estate at scoping, you license it, and we run it from there.
Is internal or external scanning covered?
The service is primarily about internal scanning, because that is where the volume, the noise and the hard prioritisation decisions live. External scanning is included whenever you want it: if your scanner covers your internet-facing estate, those findings flow into the same prioritised view at no extra band.
How does the PCI ASV add-on work?
It is priced per year and covers the four quarterly ASV scan cycles PCI DSS requires, including one rescan cycle after failures. The scans run through a PCI-SSC Approved Scanning Vendor partner; we scope the perimeter, interpret the results, drive the fixes and hand you the attestation evidence.
When does Complex become a quote?
When the estate genuinely stops fitting a published band: several scanners feeding one view, multiple subsidiaries, or contractual reporting obligations that reshape the service. The quote is built from the same arithmetic as the published bands, so you can check our workings against this page.
The price is already public
Match a band to your estate in one call
One short call counts what you actually expose, confirms the band and books the first scan at the figure printed above. There is nothing to negotiate, because the price was public before you rang.