Pricing
₹1,499 per analyst. Nothing else is metered.
Not per engagement, not per client, not per report, not per scan. The number of people doing the work is the only thing that changes what you pay — which is also the only variable you can predict at the start of a year.
Per analyst
₹1,499per analyst / month
Every capability on every seat. A two-person shop and a forty-analyst firm run the same software; the only difference is how many people are logged into it.
- Unlimited engagements, unlimited clients, unlimited scans and reports
- All five scanner formats, with parsed, rejected and duplicate counts that reconcile
- CVSS computed from the vector, and CVE verification with no bypass
- Compliance gap analysis across ISO 27001, SOC 2, PCI DSS and the DPDP Act
- DOCX, PDF, JSON and the XLSX finding register
- Per-organisation encryption keys, audit log, retention policies, data residency
- A read-only client view, scoped to one engagement
- API, signed webhooks and streamed job progress
Above fifty analysts
Pricing on request
Past fifty seats the questions stop being about the software. Procurement, a data-processing agreement, single sign-on, deployment region and an onboarding of your existing engagement history are all decided in a conversation.
- Everything in the per-analyst plan, without a seat ceiling
- Single sign-on and directory-based provisioning
- A written data-flow note for your own InfoSec and DPDP review
- Deployment region chosen rather than defaulted
- A named person who has worked on the software
- Annual invoicing and a purchase-order flow
The arithmetic
Against one engagement, this is a rounding error
A methodology-driven web application test in India bills somewhere between one and three lakh, and a regulated-sector or empanelled engagement runs well past that. A five-analyst firm pays ₹7,495 a month for this — under five per cent of a single engagement, against ten to twenty hours saved on every engagement it runs. The first engagement of the month pays for the year.
Ten to twenty hours per engagement
Not the testing — the part after it. Exporting findings, cleaning them in a spreadsheet, rewriting the same remediation paragraph, rebuilding the risk matrix, and reconciling this scan against the last one by hand.
Every seat is a full seat
No feature is behind a higher tier, because a junior analyst producing an unverified report is exactly the risk this software exists to remove. Gating the CVE gate by price would be indefensible.
The register is the deliverable
The XLSX finding register imports into your client’s tracker with severity and status mapped. It is the artifact that stops the report being retyped at the other end.
Against the category
Priced below the tools you have already been quoted
The established reporting platforms are priced in dollars for a market where an analyst costs several times what one costs here. AttackForge publishes fifty dollars a user; PlexTrac will not publish at all and is sold to mid-market and MSSPs. Converted, both land well above this — and neither bills in rupees, issues a GST invoice, or lets you choose an Indian region for the data.
| Legosphere Cyber | ₹1,499 / analyst / month | GST inclusive, billed in rupees |
|---|---|---|
| AttackForge Pro | ≈ ₹4,400 / user / month | Published at $50, billed in dollars |
| PlexTrac | Quote only | Aimed at mid-market and MSSPs |
| A spreadsheet and an evening | Free | The real incumbent, and the one worth beating |
The last row is the one that matters. Most firms are not choosing between two platforms — they are choosing between a platform and carrying on. That is what this price is set against.
- Prices are in rupees and inclusive of GST. An invoice with your GSTIN is issued on every payment.
- Annual billing is charged at ten months for twelve months of service, on the same per-analyst rate.
- Seats are the analysts who log in. A read-only client viewer is not a seat, and never has been.
- There is no free tier and no self-serve trial: this product holds client attack surfaces, and an unpaid account holding one is a liability rather than a funnel.
- Usage is not metered. Engagements, scans, reports and exports are unlimited on every seat.
Questions
What people ask about the price
Mostly variations on “what else will you charge me for”, and the answer is nothing.
Because per-engagement pricing makes you count. The moment a tool charges by the report, somebody starts deciding which engagements are worth putting through it — and the ones that get left out are the small, rushed ones where an unverified finding is most likely to slip through. Per seat, the safe path is also the default path.
A person who logs in and works: analysts, engagement leads, reviewers. Clients reading their own engagement through the read-only view are not seats, and neither is an API integration — that is authenticated as your organisation, not as a person.
Yes. Add seats when you hire and they are billed from the next cycle; drop them when someone leaves. A consultancy’s headcount moves with its pipeline and a contract that pretends otherwise just gets renegotiated angrily.
Twelve months of service charged as ten. That is the same shape the rest of the company uses and there is no separate negotiation for it.
The card form stops and a conversation starts. At that size the deciding questions are procurement, single sign-on, a data-processing agreement and which region your data sits in — none of which are things anyone should be answering with a checkout page.
Because the thing being competed with in most firms is not another platform, it is a spreadsheet and somebody’s evening — and that costs nothing. A price low enough that nobody has to build a business case for it puts the software into engagements that a four-thousand-rupee seat would have been kept out of, and an unverified finding reaching a client is exactly what we would rather prevent at scale than charge a premium to prevent occasionally.
Not for you. A rate agreed on a subscription is the rate that subscription renews at; a change to the list price applies to new subscriptions. Being the cheap option only works if signing early is rewarded rather than punished.
No. Scan volume, engagement count, report count and export count are unlimited, and storage runs on a retention policy you set. The cost of running the models is ours to manage, not a line item that arrives as a surprise.
Get in touch
Talk to the people building it
No chatbot and no ticket queue. Tell us what your security reporting actually looks like — which tools you live in, how long a deliverable takes, what a client has sent back — and someone who works on the software will reply.
info@legosphere.com