How to compare security audit costs for SaaS startups in Japan

Do you need a third-party assessment report to submit to a customer, want to find weaknesses in key features before release, or need repeated checks during development? Your objective determines whether a one-off assessment service or ongoing use of a tool is the better fit.

Before requesting quotes, list the screens, APIs, post-login features, administrative screens, and target environments. If you also want checks on access between multiple users with different permissions or on data isolation between tenants, communicate that as well.

According to the official pages as of November 4, 2026, ThinkTrust’s Light assessment starts at ¥150,000 including tax and combines AI-powered automated testing with in-depth manual investigation for one website; retesting costs extra. EG Secure Solutions’ Express service starts at ¥300,000, combines automated testing with manual spot checks, and offers one retest within three months of report delivery. Confirm the tax treatment and any additional conditions in the quote.

Proactive Defense lists its Standard plan for 10 screens at ¥770,000 excluding tax, with retesting priced at 30% of the initial fee, and provides an example totaling ¥1,001,000. JR System offers a web assessment covering up to 30 requests and a report starting at ¥1,200,000 excluding tax, with a report briefing and retesting charged separately. Screen counts and request counts are not the same unit of measurement.

For ongoing checks, Securify’s Starter plan covers 1 IP address/FQDN under a 12-month contract at ¥600,000 annually, equivalent to ¥50,000 per month, with no limit on the number of assessments. This is a tool-use plan; manual assessments by engineers require a separate quote. It does not necessarily include the same deliverables as a one-off expert assessment.

These are examples of potential providers for which public information was available, not a guarantee of the lowest price or a comprehensive ranking. Prices vary with scope and contract terms, so provide the same requirements to each provider and compare written quotes.

Our own options should also be compared by their different purposes. The Hi AUDIT vulnerability assessment costs a flat ¥480,000 before tax and investigates whether published vulnerabilities affect your system, reporting impact and remediation guidance; agree on scope and retesting terms in advance. Hi AUDIT Agent is a development-time code-analysis tool. Individual Pro is US$20 per month including tax, while team and organization use requires an Enterprise quote; its output is not automatically equivalent to an independent assessment report.

For example, using JR System’s reference prices, adding one report briefing and one retest at their respective minimum prices to an assessment and report covering up to 30 requests gives ¥1,200,000 + ¥150,000 + ¥360,000 = a starting total of ¥1,710,000, excluding tax. Retesting covers vulnerabilities detected in the initial assessment, and the cost of any additional scope must be confirmed separately. This calculation is neither a quote nor a contract amount.

Similarly, include your own team’s time in the budget. If preparation takes 4 hours, reviewing findings takes 6 hours, and retesting takes 10 hours, at an assumed hourly rate of ¥6,000, the total is 20 hours and ¥120,000. These are not measured figures, but they illustrate how to account for internal time alongside outsourcing costs. Add time for implementing fixes and explaining the results to customers as needed.

Your comparison table should include the features covered and how they are counted, the scope of manual testing, authenticated screens and APIs, reports, report briefings, retesting, delivery timelines, taxes, and additional fees. For SaaS in particular, confirm how the assessment will distinguish between regular-user and administrator permissions and test access to other companies’ tenants.

If costs look likely to exceed the budget, the key is not to cut scope indiscriminately, but to prioritize sensitive data and features directly affecting customers, while explicitly documenting any areas left unassessed. Also plan for reassessment as changes are made after release.