Fees & Engagement Models
Flexible cybersecurity pricing built around scope, risk, technology and measurable outcomes—not a one-size-fits-all hourly tariff.
Customer needs and technical scope come before a rate card.
Cybersecurity work is rarely comparable hour-for-hour. A focused advisory session, a web application test, a multi-week red team exercise and a forensic investigation require different skills, tools, evidence handling and levels of risk. Hackabby therefore prices each engagement according to the actual requirement.
Free Consultation & Initial Assessment
R0
Our first consultation and initial high-level assessment are offered without charge so that we can understand the need, define the likely scope and recommend the most practical engagement model.
Flexible Hourly Work
From R550/hr
Used where an hourly model is appropriate. International clients can be quoted in USD or GBP; as an indicative September 2026 equivalent, R550 is approximately US$34 or £25. Final foreign-currency quotes use the prevailing exchange rate.
Retainer / SLA
Scoped
Monthly retainers and managed-service agreements are priced around service hours, response commitments, technology stack, coverage, reporting and agreed performance or SLA requirements.
Quoted for the customer, scope and jurisdiction.
Hackabby supports customers in South Africa, the United Kingdom and the United States. Engagements can be quoted in ZAR, GBP or USD, with the final commercial structure based on scope, specialist effort, technology stack, service levels, data sensitivity, travel or onsite requirements and contracting terms.
South Africa
ZAR-based project fees, retainers, managed services and specialist time.
United Kingdom
GBP quotations for agreed UK-facing projects, subject to scope and contracting requirements.
United States
USD quotations for US-facing projects, with sector and state requirements considered during scoping.
Published rates vary widely—and scope is the biggest driver.
Public South African pricing examples show that specialist cybersecurity and forensic work is commonly sold by project, scope, day-rate, retainer or specialist time. Published examples include forensic consultation around R1,200 per hour and penetration-testing engagements ranging from a few thousand rand for automated scans to tens of thousands for manual testing and substantially more for enterprise red-team work.
Typical Commercial Specialist Reference
R1,200 – R1,950+ per hour
R8,000 – R15,000+ per day
These figures are included as broad market-reference bands, not a regulated or mandatory industry tariff. Hackabby may price above or below these levels depending on the scope, risk, specialist resources, travel, urgency, tooling and commercial model.
Why Hackabby Can Be More Flexible
Our multi-disciplinary team works closely with technology vendors, distributors and specialist resources, allowing us to structure engagements around the customer rather than a rigid rate card. Where suitable, we use PoV/PoC engagements, phased delivery, retainers and focused scopes to demonstrate value before larger commitments.
Indicative scoping bands—not fixed Hackabby tariffs.
Penetration tests are generally priced according to target complexity, number of applications or hosts, authentication model, APIs, infrastructure, testing depth, reporting requirements, retesting and the specialist effort required. The ranges below are useful budget guides for defined scopes.
| Engagement type | Indicative South African reference range | Typical scope drivers |
|---|---|---|
| Automated Vulnerability Scan | R2,000 – R5,000 per run | Asset count, scanning technology, validation depth and reporting. |
| Single Web Application — Manual | R8,000 – R25,000 | Application size, authentication, roles, business logic and retesting. |
| Web Application & API | R15,000 – R40,000 | Endpoint count, auth flows, API complexity, data sensitivity and abuse cases. |
| Infrastructure & External Network | R10,000 – R30,000 | Hosts, IP ranges, exposed services, cloud scope and test windows. |
| Full-Scope / Red Team | R60,000 – R250,000+* | Duration, objectives, attack paths, social engineering, internal access, physical scope, stealth and reporting. |
*Large enterprise and multi-week red-team programmes can vary materially. Hackabby confirms a formal quotation only after scoping and authorisation.
Hackabby Penetration Testing Fees Can Differ
We do not simply multiply every project by an industry hourly rate. Fees are adjusted according to scope size, technology stack, manual effort, tooling, risk, reporting depth and the required Rules of Engagement. Where practical, a first consultation, high-level assessment, Proof of Value or Proof of Concept can be used to establish fit before a broader commitment.
Forensic pricing reflects specialist analysis and evidence handling.
Digital forensic and incident-response engagements can involve evidence preservation, chain of custody, legal sensitivity, endpoint acquisition, log analysis, timeline reconstruction, malware or compromise investigation, and defensible reporting. The work is therefore scoped according to urgency and evidential requirements.
Initial Specialist Consultation
Market example: R1,200 – R2,000/hr
Hackabby's first consultation and initial assessment are free. If specialist investigation continues on an hourly basis, the agreed rate is confirmed before work proceeds.
Incident Response / Forensic Retainer
Customer-specific
Enterprise availability or retained DFIR services may be structured as monthly retainers, but Hackabby prices these around the required response model, technology stack, SLA, evidence handling, coverage and performance obligations rather than publishing a single fixed monthly figure.
Clear scope. Clear authorisation. Clear deliverables.
Every substantive engagement is governed by appropriate commercial and security controls so both parties understand the work, responsibilities, limitations and expected outcomes.
Confidentiality
NDA and privacy controls protect sensitive customer, technical and forensic information.
Commercial Framework
Master Services Agreement, SLA or project terms define commercial responsibilities and service expectations.
Technical Authorisation
Rules of Engagement and a clear Statement/Scope of Work define authorised targets, methods, timing, escalation and deliverables.
Tell us what you need protected, tested, investigated or implemented.
Whether you need a fixed-scope assessment, an hourly specialist, a monthly retainer, an active-incident response engagement, a managed security service, or a PoV/PoC for a cybersecurity solution, we will first understand the requirement and then provide a tailored quotation.