Clear, transparent pricing
trusted by 1000+ businesses

Simply put, a domain with all its site tree URLs is a target. A target can be the URL of a web application, IP, website, or API. If your website makes API calls to different domains (e.g., api.example.com), you can add them as an extra host during setup without purchasing another target — all calls to api.example.com from example.com will be scanned too.

Yes! We offer meaningful discounts for multi-year commitments and for customers who bundle multiple products (e.g., DAST + PTaaS + API Security). Contact our sales team to discuss a custom pricing plan tailored to your security roadmap.

Yes. Our PTaaS pentest reports are designed to meet the requirements of SOC2 Type II, PCI-DSS (Requirement 6.4), ISO 27001 Annex A, HIPAA, and GDPR Article 32. Auditors widely accept our reports as compliance evidence. Once remediation is verified, you also receive a publicly verifiable pentest certificate.

Automated scans test for 10,000+ known vulnerabilities including OWASP Top 10, CVEs, misconfigurations, and port/service issues. Manual pentesting by certified experts goes deeper — covering business logic flaws, price manipulation, authentication bypass chains, BOLA/IDOR, and complex multi-step attack scenarios that automated tools routinely miss.

A target is a URL that will be tested by our vulnerability scanner. It can be the URL of a web application, website, API, or IP. If you have a customer dashboard at app.example.com and an admin dashboard at admin.example.com with different login pages, those would be 2 separate targets. For SaaS apps, the entire app with all its APIs is typically 1 target.

PTaaS plans include 2 free retests by our pentesters to validate fixes. For DAST Scanner customers, you can re-scan individual vulnerabilities directly from the dashboard after applying fixes — without needing to run a full scan again. Enterprise plans include unlimited retests.

Automated DAST scans complete within 24 hours. Manual penetration testing takes 10–14 business days including testing, report writing, and initial review. Rescan turnaround is typically 2–3 business days after fixes are submitted. We always agree on a timeline before any engagement begins.

Yes! While we don't fix vulnerabilities for you, we actively assist your developers through the remediation process. Your developer can comment under each vulnerability in the dashboard to ask questions, get clarifications, or request guidance. Our security team responds typically within 24 hours to help unblock remediation.