The full tool suite
Every scan runs the same discovery, assessment and configuration checks. There is no cheaper tier that quietly skips half of them.
Pricing
Pay per scan. No subscription.
Scan time scales with the number of addresses in scope, so the price does too. The band is worked out from the target you enter — you'll see the exact figure before you're asked for a card.
| Scope | Addresses | Price | Covers |
|---|---|---|---|
| Single host | 1 | $99 | One domain, hostname, or IP address. |
| Small estate | up to 16 | $249 | Up to 16 addresses - a small office or a /28. |
| Medium estate | up to 64 | $599 | Up to 64 addresses - a /26 or a handful of subnets. |
| Large estate | up to 256 | $1,499 | Up to 256 addresses - a full /24. |
| Extended estate | 257 – 4096 | $3,499 | Above 256 addresses, up to the platform ceiling. |
A hostname counts as one address. 4096 addresses is the platform ceiling for a single order — split anything larger across several.
Every scan includes
Analyst review
A person reads the findings and approves the report before you see it. Draft output is never delivered.
A written report
A PDF you can hand to a client, an auditor or your own board — with severities, evidence and remediation steps, not a list of CVE numbers.
Ownership verification
We confirm you control the target before scanning. That record is what makes the engagement defensible if anyone asks.
Client portal access
Track the scan while it runs and download the report when it's ready, for as long as we hold it.
Deletion on a clock
Reports, raw output and findings are purged automatically. We don't keep a permanent library of your weak points.
Optional extras
Chosen per order, at checkout.
Premium analysis
$149 CAD
Your findings are written up by a frontier language model rather than our self-hosted one. Longer, better-contextualised remediation advice, and clearer explanations of why a finding matters to your specific setup.
Intensive web scan
$49 CAD
Adds an exhaustive web-path probe that checks for thousands of known-bad URLs. It finds more, and it is loud — expect it to show up in your logs and possibly trip a WAF. Only worth enabling if you can warn whoever watches those alerts.
Questions people actually ask
Is this a penetration test?
No, and the distinction matters. This is vulnerability scanning: we identify and report weaknesses without attempting to exploit them. Nothing we run is designed to alter, damage or gain access to your systems. If you need someone to actually break in and prove impact, you want a pentest, which is a different engagement with a different price.
What counts as proof that I own the target?
For a domain or hostname: a DNS TXT record we give you, or a file we give you placed at a .well-known URL. Both are checked automatically. For bare IP addresses or CIDR blocks, neither works, so we ask for a signed authorisation document or equivalent written permission, and an analyst reviews it by hand.
When am I actually charged?
Your card is authorised at checkout but not charged. We capture the payment only once an analyst has confirmed your ownership evidence and the scan is cleared to run. If we can't verify it, the authorisation is released and no money moves.
Will the scan take my site down?
It should not. Nothing destructive runs, and denial-of-service checks are disabled in code with no setting to turn them back on. The one intensive option — the exhaustive web-path probe — is off unless you deliberately add it, because it generates a lot of traffic and may trip a WAF or an IDS.
What happens to my data afterwards?
Report PDFs, raw scanner output and individual findings are all deleted automatically once they pass the retention window. Your authorisation evidence is kept for as long as the order exists, because that is the record proving the scan was permitted.
Can I scan something I don't own?
No. Ownership verification is not a formality we will waive, and an order that fails it is rejected and refunded rather than run.