Start with one test. Or test every release.
Full penetration test. Full report. Within 48 hours. Fixed prices in USD, human-reviewed findings, and no sales call needed to start.
Continuous
Security that keeps testing.
or $8,990/year
For teams that ship frequently and need security to keep pace.
- 1 application
- Daily attack-surface watch
- Scheduled offensive testing every month
- 2 release tests a month
- Verified findings and unlimited retests
- Security history and monthly snapshots
- Continuously tested badge
3-month minimum
Growth
For teams shipping every week.
or $19,990/year
The full loop across your products, at release speed.
- Everything in Continuous
- Up to 3 applications
- 2 release tests per application a month (up to 6)
- Priority scheduling
Enterprise
Security for larger attack surfaces.
For organizations with broader security requirements.
- Application portfolio testing
- Higher testing volume
- Cloud and infrastructure
- Custom scope and SLA
- Source-assisted, AI/MCP and mobile testing
- Compliance evidence
- Procurement and security requirements
| Feature | Continuous | Growth | Enterprise |
|---|---|---|---|
| Price | $899/month or $8,990/year | $1,999/month or $19,990/year | From $40,000/year |
| For | Teams that ship too often for annual pentesting | Multiple products and releases | Broader security requirements |
| Applications | 1 | Up to 3 | Application portfolio |
| Human testing | A testing pass every month | A testing pass every month, priority scheduling | Higher volume, dedicated security engineering |
| Release tests | Up to 2 a month | 2 per application a month (up to 6) | Custom |
| Automated monitoring | Daily external attack-surface checks | Daily, on every application | Custom, including cloud and infrastructure |
| Retests | Included | Included | Included |
| Evidence | Always-current findings in the portal, verification badge | Ongoing security evidence, verification badge | Compliance evidence, security questionnaires, procurement support |
| Contract | Monthly with a 3-month minimum commitment, or yearly | Monthly or yearly | Custom SLA, MSA and DPA |
Exposure Check
Verify you own the domain with one DNS record, then get an outside-in snapshot: subdomains, certificates, headers, exposed technologies and likely exposures.
Extend any plan.
Specialist add-ons are focused reviews unless the scope is quoted as a full standalone penetration test.
| Add-on | Price | What it is | How to add |
|---|---|---|---|
| Extra application | $600 / month | Another production application on a Continuous or Growth plan, added to your subscription and prorated. | In your portal |
| Additional release test | $250 | Beyond your monthly allowance of 2 per application on Continuous or Growth. | In your portal |
| Rush turnaround | +50% | Expedited testing on a one-time plan, ahead of the standard 48 hours. Not charged at checkout: we confirm capacity, then invoice. | At checkout |
| Mobile app review | $500 / platform | A focused review of your Android or iOS app and the API it uses. Full mobile penetration tests are quoted. | At checkout |
| Source-code review | from $1,500 | A focused review of the code behind your highest-risk flows. | |
| AI / MCP security review | from $1,500 | Focused review of prompts, tools, agents and MCP servers. | |
| Cloud security review | from $1,500 | Read-only review of AWS, GCP or Azure configuration and permissions. |
What the words on this page mean.
The same definitions apply in checkout, the terms and every agreement. All prices are in USD.
- 1 application
- One production domain and its associated API, one staging copy, and up to 3 user roles.
- 48-hour turnaround
- The 48 hours start once scope, written authorization, target details and test access are confirmed. If access is delayed or the scope grows significantly, the clock pauses until it's resolved.
- Retest
- Verification of previously reported findings after remediation: we replay the original attack path and record whether it still works.
- Release test
- A targeted security test of a material release or change within the agreed application scope.
- Additional application
- A production application, domain or API outside the original application definition.
- Rush
- Expedited testing ahead of the normal 48-hour commitment, where Zentinel agrees to prioritize the engagement.
An MSA and DPA are available on request for any plan, not only Enterprise.
Questions buyers actually ask.
How fast do I get results?
Full penetration test. Full report. Within 48 hours. Once scope and access are confirmed, you get a complete, human-reviewed penetration test and a full technical report in 48 hours. The 48 hours start once scope, written authorization, target details and test access are confirmed. If access is delayed or the scope grows significantly, the clock pauses until it's resolved.
Is Zentinel automated?
Parts of the platform automate external attack-surface discovery and change detection. Security testing and finding verification are human-led: an engineer reproduces every finding before you see it.
Which plan should I start with?
Need a serious test now: Launch. Preparing for customers, launch or fundraising: Startup. Facing a SOC 2 audit: SOC 2-Ready. Shipping every week: Continuous. Several products: Growth. Procurement-driven: Enterprise. Not sure what you look like from outside? Start with the free Exposure Check.
What exactly does Continuous include?
Automated monitoring checks your external attack surface every day. A human testing pass runs every month. When you ship something significant, you request a release test from the portal: two a month per application, so up to six on Growth across three applications. Every finding is validated by a person and retested after you fix it.
Is there a minimum term?
Continuous has a 3-month minimum commitment when billed monthly, or costs $8,990 a year. Growth is $1,999 a month or $19,990 a year. Yearly billing on either is the price of 10 months for 12. Enterprise is an annual agreement.
Why do I have to verify my domain for the free check?
Because we only look at domains whose owners ask us to. One DNS TXT record proves you control the domain; you can delete it afterwards. It keeps the free check what it should be: a service to owners, not reconnaissance on strangers.
Will this satisfy SOC 2 or ISO 27001?
The SOC 2-Ready Penetration Test is built to be handed to your auditor: documented methodology, evidence, CVSS scoring, a retest, and an audit-ready report and evidence package. It is not a SOC 2 attestation. Your SOC 2 auditor stays independent, and we provide the penetration-testing evidence they ask for.
Which standards do you follow?
Web testing uses OWASP WSTG v4.2 as its baseline, API testing references the OWASP API Security Top 10 (2023), OWASP ASVS 5.0.0 is our scoped verification reference, OWASP MASVS 2.1.0 and MASTG cover mobile, OWASP guidance for LLM, agentic and MCP security covers AI, and PTES shapes our assessment phases. Severity uses CVSS v3.1. These are references for our process, not certifications.
Do you only test web applications?
No. Depending on scope, Zentinel assesses APIs, authentication, authorization, cloud exposure, business logic, mobile app backends and AI / MCP surfaces.
Do you test mobile apps?
Yes, as an add-on to any one-time plan: a focused review of your Android or iOS app and the API it talks to, $500 per platform. Full mobile penetration tests are scoped and quoted separately.
We bought Launch or Startup. What if we move to Continuous?
Upgrade within 30 days and 100% of what you paid is credited toward Continuous. If the credit is larger than one invoice, the rest carries onto the next ones.
Do you sign MSAs and DPAs?
Yes, on any plan where you need one, not only Enterprise.
Do you need source code?
Not necessarily. Scope determines what access is useful. Most assessments start black-box with test accounts; source access can make a review deeper where it matters.
How often do you test?
A one-time assessment is point-in-time: it tests what you have today. Continuous keeps the loop running: daily automated monitoring, a monthly human testing cycle, and targeted tests when you ship.
Do you exploit vulnerabilities?
Only within explicit written authorization and the agreed scope. We demonstrate impact, then stop. No denial-of-service, no destructive operations.
Do you access customer data?
Testing is designed to minimize data exposure. Evidence is limited to what is necessary to establish impact, and it is redacted in the report.
Do you provide retesting?
Yes. When you ship a fix, request a retest from the finding in your portal. We replay the original attack path and record whether it still works.
Can customers verify their assessment?
Yes, where enabled. Your organization owner can publish a Zentinel badge that links to a public verification page confirming your application is tested by Zentinel and whether testing is active. It never shows findings, dates or test details.
Will testing take down production?
Testing is non-destructive by default. We do not run load tests, floods or mass sign-ups, and critical issues found mid-test are reported immediately rather than at the end.
Your application keeps changing.
Your security should keep testing.
Put your application into the Zentinel loop.
Authorized testing only. All testing occurs within agreed scope and rules of engagement.