Security baseline
$3,500-$7,500
Defined environment, usually 1-2 weeks
- Five-area assessor-rated scorecard
- Evidence-bound findings register
- Leadership and technical reports
- 30 / 60 / 90-day action plan
- Readout and retest options
Pricing and scope
Clear planning ranges. A fixed fee before work starts.
Use these ranges to decide whether an assessment fits the budget. After a short scope review, the written proposal names the systems, methods, schedule, deliverables, exclusions, retest terms, and total fee.
Published planning ranges
Start with the smallest engagement that answers the question.
Prices are in US dollars. The range reflects scope and effort, not finding count. A signed proposal sets the final fixed fee.
Multi-system baseline
$8,000-$18,000+
Multiple locations, tenants, or applications
- Everything in the baseline
- Broader cloud, identity, or application depth
- More stakeholder and evidence coverage
- Prioritized cross-system relationships
- Defined post-fix verification tranche
One system or question
$1,500-$5,000
Usually 3-10 business days
- Defined application, API, cloud, device, or finding
- Controlled technical validation
- Evidence and practical impact
- Corrective direction
- Closure criteria or retest record
Scheduled assurance
$750-$2,500 / month
Monthly or quarterly review cadence
- Agreed exposure and evidence refresh
- Remediation and exception tracking
- Priority retesting within the active scope
- Score and risk trend updates
- Leadership review at the agreed cadence
Systems and boundaries
Domains, public services, cloud or identity tenants, applications, APIs, locations, devices, and third-party dependencies included in writing.
Assessment depth
Configuration review, artifact analysis, authenticated testing, business-logic validation, evidence review, stakeholder interviews, and retest depth require different effort.
Operating constraints
Maintenance windows, fragile systems, request pacing, test identities, data-handling rules, approval gates, and customer change controls affect the schedule.
Delivery and follow-through
Board or insurer formats, multiple technical teams, white-label delivery, custom-domain setup, implementation support, and included retests are stated separately.
Every proposal
Know exactly what is included.
Argus does not increase the price because an assessment finds more problems. New systems or techniques require an agreed written scope change.
| Included term | What the proposal states |
|---|---|
| Authorization | The legal entity, systems, dates, permitted methods, exclusions, request limits, stop conditions, and contacts. |
| Customer inputs | The access, test accounts, architecture context, inventory, interviews, and evidence the customer must provide. |
| Deliverables | The leadership summary, technical register, scorecard when applicable, action plan, readout, and any portal or white-label delivery. |
| Schedule | Expected start, assessment window, draft review, final delivery, and retest window. |
| Commercial terms | The fixed fee, payment milestones, included retest, optional work, and conditions that require a written change. |
Common questions
Pricing without fine print theater.
Will the final fee always fit a range?
Most bounded small and mid-market work should. A large, regulated, multi-location, or unusually constrained environment may exceed it; the proposal will say so before work begins.
Is remediation included?
The report and planning support are included as stated. Hands-on implementation is separate unless the proposal explicitly includes it, which keeps assessment conclusions independent.
Is a retest included?
The baseline defines retest options. Some proposals include one bounded verification round; others price it as Argus Verify. The exact condition and window appear in writing.
Is Argus Watch a 24/7 SOC?
No. It is scheduled exposure, evidence, remediation, and verification review. It does not include continuous endpoint monitoring or emergency incident response.
Get a fixed proposal
Tell us what the business depends on.
A short scope review is enough to identify the smallest useful engagement and a fixed fee. Submitting the form does not authorize testing.
Request pricing and scope