Pricing
Vexta plans are ready to buy, billed monthly, quarterly or yearly. Pentest, managed IT, cloud, vCISO, attack-surface and incident-response starting prices are published below, and every engagement gets a fixed quote to its scope within one business day.
Pick a category and choose your billing period - the final total, including any discount and add-ons, is confirmed at checkout.
Vexta free trial: Pro for 14 days, 25 scans, no card required.
Self-hosted - you install the binary on your own machine. When the trial ends, scanning stops and nothing is charged; buy Pro and the same key carries on.
AI-powered security scanner licenses.
For bug hunters and solo researchers.
For security teams and full-time hunters.
For red teams and enterprises.
What each plan unlocks in the Vexta binary. Prices are on the cards above.
Swipe the table sideways to see every plan.
| Feature | Essentials | Most popularPro | Enterprise |
|---|---|---|---|
| Scans per month | 10 | 100 | Unlimited |
| Proof-of-exploitation verification | Included | Included | Included |
| Authenticated (logged-in) scanning | Not included | Included | Included |
| Scheduled scans | Not included | Included | Included |
| Reports | Dashboard + JSON | HTML, PDF, SARIF | HTML, PDF, SARIF |
| CI/CD pipeline command (SARIF, JUnit, JSON) | Not included | Included | Included |
| Local NVD, EPSS and KEV mirror + dependency (SCA) checks | Not included | Included | Included |
| Optional AI triage with your own LLM key | Not included | Included | Included |
| Team access control + compliance evidence packs | Not included | Not included | Included |
| Support | Email, 24-hour first response | Email, 4-hour first response + named consultant |
| Feature | Essentials | Most popularPro | Enterprise |
|---|---|---|---|
| Included on every plan | |||
| Passive OSINT recon and subdomain enumeration across 40+ public sources | Included | Included | Included |
| Asset intelligence: host, IP, open ports, technology stack and TLS certificate summary | Included | Included | Included |
| Core web vulnerability checks for OWASP Top 10 classes (SQL injection, reflected XSS, command injection, file inclusion, CRLF, open redirect, CORS) | Included | Included | Included |
| 10,000+ bundled vulnerability templates in every binary (community templates from ProjectDiscovery’s nuclei-templates) | Included | Included | Included |
| JSON scan output and a native Word (DOCX) report on every scan | Included | Included | Included |
| Built-in dashboard with real-time updates and a light or dark theme | Included | Included | Included |
| WAF detection and adaptive rate limiting | Included | Included | Included |
| Plain-language explanation, impact and CWE/OWASP references on every finding | Included | Included | Included |
| Recon and discovery | |||
| Content and URL discovery: Wayback history, directory and content fuzzing, exposed-file checks and injection-class bucketing | Included | Included | Included |
| Network port and service scanning (SYN and ACK scans, service detection) | Included | Included | Included |
| Archive URL aggregation (CommonCrawl, OTX, URLScan) | Not included | Included | Included |
| Per-host screenshots and active OS fingerprinting | Not included | Included | Included |
| Cross-scan asset diffing (new, changed and removed assets) | Not included | Included | Included |
| Subdomain-takeover and lookalike-domain detection | Not included | Included | Included |
| Cloud storage bucket enumeration (S3, GCS, Azure) | Not included | Included | Included |
| Leaked-secret and credential-exposure checks: GitHub and GitLab dorking, exposed .git history, breach lookups | Not included | Included | Included |
| Web-app cataloguing and origin-server discovery | Not included | Included | Included |
| Related-infrastructure discovery across an organisation | Not included | Not included | Included |
| Vulnerability scanning | |||
| Source-code pattern (SAST) checks: SSRF, XXE, weak crypto, SQL concatenation, path traversal and more | Included | Included | Included |
| Cross-site scripting: DOM-based, stored, blind (out-of-band), multi-step and charset-confusion | Not included | Included | Included |
| Injection testing: SSTI, SSRF (including cloud metadata), XXE, NoSQL and command injection | Not included | Included | Included |
| GraphQL security checks (introspection, batching, auth gaps, DoS) | Not included | Included | Included |
| HTTP request smuggling (CL.TE, TE.CL, multi-header) | Not included | Included | Included |
| Race-condition testing (single-packet, workflow, idempotency) | Not included | Included | Included |
| Web3 and smart-contract checks, and mobile app (APK/IPA) analysis | Not included | Included | Included |
| Request-forgery and parameter abuse: CSRF strength, chained CSRF, on-site request forgery, clickjacking, parameter pollution | Not included | Included | Included |
| Other web flaws: file-upload polyglots, ViewState tampering, format strings, SOAP and SMTP injection, prototype pollution, risky third-party scripts, denial-of-service | Not included | Included | Included |
| Advanced injection detection (timing and boolean oracles, second-order injection, encoding variants) | Not included | Included | Included |
| Login and authentication flaws: username enumeration, missing lockout, multi-step login and step-skipping | Not included | Included | Included |
| Session and cookie security: fixation, weak entropy, predictable tokens, padding oracles, scope and cross-response differences | Not included | Included | Included |
| Broken access-control differential checks (method, header, sitemap, parameter-trust and Referer-based checks) | Not included | Included | Included |
| SSO, OAuth and OIDC flaws and account-takeover chains (redirect, state, PKCE, password-reset host injection) | Not included | Included | Included |
| Network service checks: FTP bounce, ident leak, SNMP write, RPC and SMB null-session enumeration, idle scan, WebDAV | Not included | Included | Included |
| Additional checks: TLS certificate (null-byte CN/SAN, wildcard scope), sitemap and framework discovery, Microsoft 365 configuration | Not included | Included | Included |
| Authenticated (logged-in) and headless-browser scanning | Not included | Included | Included |
| Offensive and infrastructure testing | |||
| Network service exploitation (SSH, SMB, RDP, LDAP, SNMP) | Not included | Included | Included |
| Intercepting proxy: live feed, request replay and edit, per-host TLS and scope filtering | Not included | Included | Included |
| Broken access control / BOLA differential testing (IDOR, session-matrix auth diff) | Not included | Not included | Included |
| Dedicated SSO, SAML and OIDC misconfiguration scanning | Not included | Not included | Included |
| Credential engine: tests discovered credentials against live services | Not included | Not included | Included |
| Active Directory auditing and red-team modules (BloodHound graph, Kerberoasting, NTLM relay, DCSync, PsExec/WinRM/WMI, Zerologon, PetitPotam) | Not included | Not included | Included |
| Cloud infrastructure auditing (AWS, Azure, GCP) | Not included | Not included | Included |
| Offline password cracking (hashcat) | Not included | Not included | Included |
| Wi-Fi assessment agent | Not included | Not included | Included |
| Command-and-control egress testing | Not included | Not included | Included |
| Phishing simulation toolchain for authorised campaigns | Not included | Not included | Included |
| Red-team engagement reporting | Not included | Not included | Included |
| Database capability and out-of-band probes (MSSQL, Oracle, OLE DB, stored-procedure and SMTP-collaborator checks) | Not included | Not included | Included |
| Verification and intelligence | |||
| Proof-of-exploitation verification on every finding (proven, refuted or unproven) | Included | Included | Included |
| Out-of-band (OOB) callbacks for blind SSRF, XXE and XSS | Not included | Included | Included |
| CVE matching with a local NVD mirror plus EPSS and KEV enrichment, and dependency (SCA) checks | Not included | Included | Included |
| Full confidence scoring (severity, proof, reachability, EPSS, KEV) | Not included | Included | Included |
| Interactive attack-graph view of findings | Not included | Included | Included |
| Fix verification and baseline scanning (only new issues since a known-good run) | Not included | Included | Included |
| Application security posture management: asset criticality, reachability and SLA banding | Not included | Not included | Included |
| Attack-path chaining and exploit-chain analysis | Not included | Not included | Included |
| Reporting | |||
| HTML, PDF and Google Docs reports with executive summary and remediation | Not included | Included | Included |
| SARIF (GitHub and GitLab code scanning) and JUnit output | Not included | Included | Included |
| Cross-scan diff reports, reproduction packages and one-click export to HackerOne and Bugcrowd | Not included | Included | Included |
| CI/CD and integrations | |||
| CI/CD pipeline command that fails builds on the severities you choose | Not included | Included | Included |
| Notifications: email, Microsoft Teams, Google Chat, Pushover and custom webhooks | Not included | Included | Included |
| Scheduled scans and targeted subscans | Not included | Included | Included |
| REST API access, findings query language and endpoint change timeline | Not included | Included | Included |
| Optional AI (your own LLM key) | |||
| Optional AI triage, asset insight, report drafting and scan planning, using your own LLM key | Not included | Included | Included |
| AI-assisted configuration and security analysis, using your own LLM key | Not included | Not included | Included |
| Team and compliance | |||
| Compliance mapping (OWASP, NIST, PCI-DSS, SOC 2), evidence packs and PDF export | Not included | Not included | Included |
| Team access with role-based permissions and an admin audit log | Not included | Not included | Included |
| Platform, scale and audit | |||
| Quick and standard scan profiles | Included | Included | Included |
| Deep, bounty-hunt and low-noise scan profiles | Not included | Included | Included |
| Multi-target scanning and higher concurrency (up to 50 threads) | Not included | Included | Included |
| Tamper-evident, hash-chained audit trail of every request | Not included | Included | Included |
| Unlimited targets and concurrent jobs, up to 100 threads, and unrestricted API | Not included | Not included | Included |
| Finding lifecycle metrics (MTTR, recurrence, SLA breaches) | Not included | Not included | Included |
| Custom YAML scan profiles | Not included | Not included | Included |
Hunter math: Essentials covers 10 full scans a month, Pro covers 100 - and every plan ships with Proof-of-Exploitation verification, so you spend time on real bugs, not false positives. Annual Essentials works out to roughly one medium bounty for the year.
PRICES IN INR & USD · POE INCLUDED AT EVERY TIER
Each service shows its starting price. Every package is quoted to your scope as a fixed price, within one business day, and each service page says what moves the number. Retainers are billed monthly in advance; annual prepay gets 10% off.
Fixed-price proposal per engagement. The price moves with the number of applications, APIs, and any internal or cloud scope.
Starting from
$2,399fixed price
Web application pentest · A single small web application
Fixed-price proposal before any testing starts
Flat monthly retainer sized by your estate, not your headcount. Labour only.
Starting from · Essential
$999/ month
Essential · Small office
Up to 25 endpoints + 2 servers
Standard · Most SMBs start here
Up to 75 endpoints + 5 servers
Complete · 24x7 + compliance
Up to 200 endpoints + 15 servers
Monthly retainer. Three-month minimum, then month to month.
Starting from · Strategic Advisor
$2,099/ month
Strategic Advisor · 4-8 hours / month
Monthly security review with your leadership
Engaged vCISO · 15-25 hours / month
Everything in Strategic Advisor, plus: Security roadmap with quarterly milestones
Full vCISO · 40+ hours / month
Everything in Engaged, plus: Acts as your CISO in customer and investor conversations
Monthly, sized by root-domain count and alert depth. Extra domains charged per domain.
Starting from · Discover
$139/ month
Discover · For small SMBs
Up to 2 root domains
Monitor · For growing teams
Up to 10 root domains
Manage · For mid-market + SDFs
Domain count scoped to your estate
Retainers are monthly. Emergency work without a retainer is hourly.
Starting from · Standby Retainer
$479/ month
Standby Retainer · Baseline readiness
4-hour response time guarantee
Active Retainer · Real readiness
2-hour response time
Dedicated Retainer · For SDFs + regulated
Named responders on call
Managed and Platform bill the greater of the retainer or 12% of cloud spend.
Starting from · Review
$639/ month
Review · Fixed monthly
Monthly cost and security posture review
Managed · Or 12% of cloud spend
Everything in Review, plus: Infrastructure-as-code ownership
Platform · Or 12% of cloud spend
Everything in Managed, plus: Architecture ownership
Sprint is fixed-price. Transformation is scoped per programme.
Starting from · Fractional CIO
$1,999/ month
Fractional CIO · 10 hours / month
10 hours a month
Advisory Sprint · Two weeks
Two weeks, fixed scope
Transformation · 3-month minimum
Programme ownership with delivery accountability
ISO 27001, SOC 2, GDPR and DPDP readiness work is scoped per client - the size of the estate moves the price far more than the size of the company, so a list price would be a guess. Get a quote and we come back with a fixed price within one business day, or book a call if you would rather talk the scope through.
Tell us what triggered this and when you need it by; we'll suggest a service and come back with a fixed price.
