Vulnerability Scan Pricing: The Three Models
- Scan pricing comes down to one question: what counts as a unit, a scan, an application or an asset.
- The unit, multiplied by your cadence and your footprint, predicts the invoice. The headline price does not.
- Published figures range from $49 per scan to licence fees in the thousands per year, and they are not addressing the same purchase.
- Triage time never appears on a price list, and it is usually the largest line of the real cost.
The unit is the product
Three billing models cover most of this market, and each one prices something different.
Per scan. One credit, one test of one target. The bill follows how often you test. This is how we sell, at a founding rate of $49 per scan and a standard rate of $79 (pricing page, read 23 October 2026).
Per application. One application for one engagement or one subscription, whatever the number of hostnames behind it. Manual engagements are quoted this way, and so are application-security platforms that sell a seat per product.
Per asset, or per licence. Continuous exposure platforms charge an annual platform fee by tier, then bill the scanning separately, per domain or per target. The bill follows the size of the external footprint: more subdomains, more money, at the same depth on each.
A fourth model exists and it is worth naming because it is the one small teams get caught by: an annual licence with a scan quota inside it. The fee is fixed until you exhaust the quota, and then it is not.
Published prices, and the date they were read
Every figure below was read on the page named. Where the figure comes from a comparison we published, the consultation date recorded there is carried over unchanged, because a price we did not re-read this week is not a price we assert today.
| Vendor | Model | Published figure | Source, and date |
|---|---|---|---|
| BreachVex | Per scan | $49 founding, $79 standard | breachvex.com/pricing, read 23 October 2026 |
| BreachVex | Monthly packs | $120/month for 3 scans, $350/month for 10 scans (founding); $199 and $499 standard | same page, read 23 October 2026 |
| Burp Suite DAST | Annual licence, custom quote | from about $6,040/year, up to $49,999+/year for unlimited concurrent scans | Burp Suite comparison, published 12 October 2026, from reported 2025–2026 community pricing |
| Detectify | Annual platform fee by tier, plus scanning per target | tiers from €0, €2,500, €5,000 and €15,000; scan prices per domain or target on quote | Detectify comparison, published 12 October 2026, vendor pricing page consulted 15 October 2026 |
Two absences are deliberate. Vendors that publish no price list, and quote only in a sales cycle, are not in this table. So is any figure we could not re-read on the vendor's own page when this was published. A pricing table assembled from other people's comparison articles is a plausible table, not an accurate one.
The arithmetic, on a concrete case
Take five applications, tested weekly, for a year.
- Per scan at the founding rate: 260 scans, so $12,740. At the standard rate, $20,540.
- Monthly packs: three scans a month is 36 scans a year and $1,440 at the founding rate. Ten scans a month is 120 scans and $4,200.
- Annual licence: the fee depends on tier and asset count, and the published ranges start around $6,040 a year at the low end.
The shape of that table is the argument. A per-scan bill grows with cadence and footprint together. A licence grows with footprint, and only sometimes with the number of runs. If your five applications sit behind twenty hostnames and you test monthly rather than weekly, the licence may well win on price. If you test on every deploy, it usually does not.
What the invoice never includes
The published price covers the test. It does not cover these, and each one lands somewhere in your organisation.
- Triage. A scan that returns candidates has handed you a queue. Someone has to read it before anything gets fixed. Ask how many findings the vendor expects per application and who they think will read them.
- Authenticated setup. Scanning behind a login needs test accounts, a decision about what data they can reach, and someone to refresh the credentials when they rotate.
- Retesting. Whether a re-scan after a fix is included, discounted, or billed as a new unit changes the annual number more than a small difference in unit price.
- Integration. Getting results into a pipeline, a ticket tracker or a dashboard is engineering time on your side, not the vendor's.
- The queue you will not read. Every tool produces findings nobody acts on. The honest cost of a scanner includes the ones you will ignore, because they still cost the reading.
Five questions that change the quote
- What counts as one unit, and does a re-scan count as a new one?
- How many of those units do I have today, and will that number grow without me deciding it?
- Does the price cover authenticated testing, and how many accounts?
- What does a finding look like, a candidate or a reproduced request?
- Who reads the queue, the vendor or my team?
A vendor who answers the fourth question with "a finding" has not answered it.
Sources
- breachvex.com/pricing, read 23 October 2026: our founding and standard scan prices, and the monthly packs.
- BreachVex vs Burp Suite Enterprise, 2026, published 12 October 2026: Burp Suite DAST licence range, from reported 2025–2026 community pricing, and the custom-quote model.
- BreachVex vs Detectify, 2026, published 12 October 2026: Detectify's annual platform tiers and per-target scanning, vendor pricing page consulted 15 October 2026.
- Penetration testing: what a test covers, published 19 October 2026: why a scan report and an engagement report are different documents.
Next step
If what you actually need is the price of a mission rather than of a scan, what a pentest costs covers the manual side with the same sourcing. If you already know you want per-scan pricing, the pricing page has the plans and what one credit covers.
BreachVex is in early access: join the waitlist and we will write when your access opens.
Frequently Asked Questions
- Why do two vulnerability scanning quotes differ so much for the same application?
- Because the unit differs. One quote counts scans, another counts applications, a third counts every host or subdomain the vendor can see. A price per scan looks cheap until you multiply it by a weekly cadence across five products, and a price per asset looks cheap until your subdomain count doubles without anyone deciding to.
- Is a per-scan price cheaper than an annual licence?
- Only above a certain cadence. At the prices published on our pricing page, a weekly scan of one application is $2,548 a year at the founding rate, which sits below the $6,040 low end of the annual licences in the table below. Run twenty applications weekly and the arithmetic reverses, because the scan model scales with both footprint and frequency while the licence scales mostly with footprint.
- What is not included in a published scan price?
- Triage time, the setup of authenticated test accounts, retesting after fixes, and the integration work if you want results in a pipeline. None of those appear on a price list, and all of them appear in your team's calendar. Ask for the triage assumption explicitly: a vendor that hands back a candidate queue is selling you work you have not staffed.
- Does a scan price include a report a customer will accept?
- Usually not. A scan report describes findings against your own system and carries reproduction detail. A report your customer's procurement team accepts is a different document, frequently produced by an independent tester. If a customer questionnaire is the reason you are buying, read the [penetration testing page](/penetration-testing) first.