Pricing
Free to start. Priced per test.
Pay for the engagement, not seats. Every tier includes the full 45-module pentest, proof re-fire on serious findings, the AI chat and a compliance-mapped report. Upgrade for the full 16-agent orchestrator, internal-network scanning and continuous monitoring.
No card to start · Team seats at no extra cost · From $2,500 per full test
Plans
Plan 00 · Free
$0No card required
Sign up and scan your own domain today. Your email domain and its subdomains are in scope by default; add any other domain by verifying you control it (DNS or file). See real proof on your own site before you buy.
Scan my domain free-
Plan 01
Standard
Lightweight apps: marketing sites, simple SaaS, low integration depth.
$2,500per test
Get startedIncludes
- Full 45-module external pentest
- Proof re-fire on serious findings, evidence on every finding
- Authenticated scans (form login, JWT, OAuth)
- Chat-driven workflow and grounded AI follow-ups
- Compliance-mapped PDF (SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, NIST CSF, OWASP)
- PoC and remediation per finding
- 1 free retest after fixes
-
Plan 02
Pro
Most popularProduction SaaS, multi-module platforms, complex auth and access patterns.
$5,000per test
Talk to salesEverything in Standard, plus
- Full 16-agent orchestrator
- Risky-subdomain auto deep-scan
- Cross-user BOLA / IDOR detector (second account)
- Internal / network scan (1 agent)
- Attack-path and blast-radius graph
- MITRE ATT&CK mapping per finding
- Dark-web and breached-credential check
- 2 free retests, 90-day finding tracking
-
Plan 03
Enterprise
Mature portfolios, multi-product SaaS, regulated industries. Continuous offensive coverage.
Quotecustom SLA
Request a quoteEverything in Pro, plus
- Continuous monitoring (1h, 6h, 12h, 24h, 48h, weekly)
- Diff-based new-finding alerts (Slack, webhook, email)
- Unlimited targets and subdomains
- Unlimited internal scan agents
- SSO, RBAC, audit log, multi-seat
- API access for CI/CD integration
- White-label PDF reports
- Dedicated CSM, custom SLA, private deployment
Prices are per target, per test. A target is one root domain plus its subdomains.
Compare
Every feature, side by side.
| Feature | Standard | Pro | Enterprise |
|---|---|---|---|
| External pentest | |||
| Full 45-module scan | Included | Included | Included |
| Proof re-fire on serious findings, evidence on every finding | Included | Included | Included |
| Validator and second-AI judge (evidence gate) | Included | Included | Included |
| Authenticated scans (form login, JWT, OAuth) | Included | Included | Included |
| Chat-driven workflow and grounded AI follow-ups | Included | Included | Included |
| Quick (~10 min) and deep scan modes | Included | Included | Included |
| Risky-subdomain auto deep-scan | Not included | Included | Included |
| Exploitation and analysis | |||
| Full 16-agent orchestrator | Not included | Included | Included |
| Cross-user BOLA / IDOR detector (second account) | Not included | Included | Included |
| WAF detection and 70+ bypass-payload scoring | Not included | Included | Included |
| Attack-path graph and blast radius | Not included | Included | Included |
| MITRE ATT&CK mapping | Not included | Included | Included |
| Dark-web and breached-credential check | Not included | Included | Included |
| Internal and continuous | |||
| Internal / network scan (agent-based) | Not included | 1 agent | Unlimited |
| Continuous monitoring (1h, 6h, 12h, 24h, 48h, weekly) | Not included | Not included | Included |
| Diff-based new-finding alerts (Slack, webhook, email) | Not included | Not included | Included |
| Reporting and compliance | |||
| Compliance-mapped PDF (7 frameworks + CWE, CVSS, MITRE) | Included | Included | Included |
| White-label reports | Not included | Not included | Included |
| Free retests after remediation | 1 | 2 | Unlimited |
| Team and integrations | |||
| SSO, RBAC and audit log | Not included | Not included | Included |
| API access for CI/CD | Not included | Not included | Included |
| Dedicated CSM, custom SLA, private deployment | Not included | Not included | Included |
| Reasoning trace per agent | Not included | Not included | Included |
| Price | |||
| Per test | $2,500 | $5,000 | Quote |
FAQ
Common questions.
Something else? Ask us; we usually reply the same business day.
How long does a scan take?
A quick scan takes about 10 minutes (typically 8 to 12). A deep scan takes about 15 to 25 minutes. The report is ready the moment the scan completes, and you can keep working in the dashboard or chat while it runs.
Is the price really per test, not per seat?
Yes. One target, one full engagement, one report. Add team seats at no extra cost. Pricing scales with engagements, not headcount.
What counts as a target?
One root domain plus its subdomains. Auto-discovered subdomains are included; the risky-subdomain auto deep-scan (admin, staging, dev, vpn, api) is included in Pro and Enterprise.
Can I try it for free?
Yes. Sign-up is free and needs no card. Your own email domain and its subdomains are in scope straight away, so user@acme.com can scan acme.com and staging.acme.com. Other domains need a quick ownership check (DNS TXT record or a well-known file). Larger or out-of-domain engagements move to a paid tier.
Will it break my site?
Testing is non-destructive by default and rate-limited. We don’t run denial-of-service tests, and a guard holds back actions that could change or delete data. See Security for how scans are kept safe.
How is this different from a Burp or Nessus scan?
Those tools hand you candidates. ZerodayIQ re-fires serious findings against a control request and drops anything without evidence, so what reaches your report carries its proof, not a queue of “potential” issues.
Are retests free?
Standard includes 1 retest, Pro 2, Enterprise unlimited. A retest replays the original proof against the same target, so you get a clean record of what was fixed.
Will my auditor accept the report?
Each finding is mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIST CSF and OWASP control IDs, with CWE, CVSS 4.0 and MITRE ATT&CK references. The report supports your audit; it is not a certification, and the decision stays with your auditor.
How does the internal scan agent work?
You install a small Docker-packaged agent on a host inside your network. It registers with a token issued by your administrator, runs network discovery, Active Directory checks and lateral-movement and privilege-escalation analysis against your private ranges, and sends findings back over an authenticated channel. Every internal engagement is reviewed and approved.
Can we run it in our private cloud?
Yes. Enterprise includes a private deployment of the same platform and agents in your environment, and you keep the keys.
What about autonomous exploitation?
Autonomous exploitation, an AI that safely attempts real exploits and stops at proof, is in early access. Tell us if you’d like to join.
Start free
Start free. Upgrade when you outgrow it.
Only domains you own and verify · Talk to sales · Book a demo