Vexta · Monthly
Vexta Pro - Monthly: vulnerability scanning that ships findings, not noise.
Everything in Essentials, plus multi-target and authenticated scanning, scheduled scans, CI/CD output (SARIF, JUnit, JSON), HTML and PDF reports, dependency checks, the intercepting proxy and optional AI triage with your own LLM key. 100 scans a month and a 24-hour response SLA. For security teams and full-time hunters.
Vexta
Vexta Pro - Monthly
Everything in Essentials, plus multi-target and authenticated scanning, scheduled scans, CI/CD output (SARIF, JUnit, JSON), HTML and PDF reports, dependency checks, the intercepting proxy and optional AI triage with your own LLM key. 100 scans a month and a 24-hour response SLA. For security teams and full-time hunters.
Billed monthly. Cancel any time.
Refunds follow our Terms: up to 80% within 30 days of your first purchase, then pro-rated for unused time on quarterly and yearly plans. Monthly plans are not refunded after 30 days.
Get started →Why this tier
What you get with Vexta.
No agents to install
A single binary on a machine you control. Point it at a target, get results.
Verified findings
Proof-of-exploitation checks on every plan mark each finding proven, refuted or unproven.
Self-hosted
Runs on your own hardware or a cloud VM (AWS, GCP, Azure or similar). Results stay there unless you turn on an integration that sends them out.
CI/CD output
Pro and Enterprise: the scan-ci command writes SARIF, JUnit and JSON and fails builds on the severities you choose.
Reports
Pro and Enterprise: HTML and PDF reports with an executive summary and remediation steps. Enterprise adds compliance evidence packs.
OWASP Top 10 and CVE checks
Web vulnerability checks for OWASP Top 10 classes on every plan; CVE matching against a local NVD, EPSS and KEV mirror, and dependency (SCA) checks, on Pro and Enterprise.
Everything in Pro.
The short list above is the headline. Open the full list for every check and capability this plan unlocks in the Vexta binary.
Show full feature list (54 features)Hide full feature list
Included on every plan
- IncludedPassive OSINT recon and subdomain enumeration across 40+ public sources
- IncludedAsset intelligence: host, IP, open ports, technology stack and TLS certificate summary
- IncludedCore web vulnerability checks for OWASP Top 10 classes (SQL injection, reflected XSS, command injection, file inclusion, CRLF, open redirect, CORS)
- Included10,000+ bundled vulnerability templates in every binary (community templates from ProjectDiscovery’s nuclei-templates)
- IncludedJSON scan output and a native Word (DOCX) report on every scan
- IncludedBuilt-in dashboard with real-time updates and a light or dark theme
- IncludedWAF detection and adaptive rate limiting
- IncludedPlain-language explanation, impact and CWE/OWASP references on every finding
Recon and discovery
- IncludedContent and URL discovery: Wayback history, directory and content fuzzing, exposed-file checks and injection-class bucketing
- IncludedNetwork port and service scanning (SYN and ACK scans, service detection)
- IncludedArchive URL aggregation (CommonCrawl, OTX, URLScan)
- IncludedPer-host screenshots and active OS fingerprinting
- IncludedCross-scan asset diffing (new, changed and removed assets)
- IncludedSubdomain-takeover and lookalike-domain detection
- IncludedCloud storage bucket enumeration (S3, GCS, Azure)
- IncludedLeaked-secret and credential-exposure checks: GitHub and GitLab dorking, exposed .git history, breach lookups
- IncludedWeb-app cataloguing and origin-server discovery
Vulnerability scanning
- IncludedSource-code pattern (SAST) checks: SSRF, XXE, weak crypto, SQL concatenation, path traversal and more
- IncludedCross-site scripting: DOM-based, stored, blind (out-of-band), multi-step and charset-confusion
- IncludedInjection testing: SSTI, SSRF (including cloud metadata), XXE, NoSQL and command injection
- IncludedGraphQL security checks (introspection, batching, auth gaps, DoS)
- IncludedHTTP request smuggling (CL.TE, TE.CL, multi-header)
- IncludedRace-condition testing (single-packet, workflow, idempotency)
- IncludedWeb3 and smart-contract checks, and mobile app (APK/IPA) analysis
- IncludedRequest-forgery and parameter abuse: CSRF strength, chained CSRF, on-site request forgery, clickjacking, parameter pollution
- IncludedOther web flaws: file-upload polyglots, ViewState tampering, format strings, SOAP and SMTP injection, prototype pollution, risky third-party scripts, denial-of-service
- IncludedAdvanced injection detection (timing and boolean oracles, second-order injection, encoding variants)
- IncludedLogin and authentication flaws: username enumeration, missing lockout, multi-step login and step-skipping
- IncludedSession and cookie security: fixation, weak entropy, predictable tokens, padding oracles, scope and cross-response differences
- IncludedBroken access-control differential checks (method, header, sitemap, parameter-trust and Referer-based checks)
- IncludedSSO, OAuth and OIDC flaws and account-takeover chains (redirect, state, PKCE, password-reset host injection)
- IncludedNetwork service checks: FTP bounce, ident leak, SNMP write, RPC and SMB null-session enumeration, idle scan, WebDAV
- IncludedAdditional checks: TLS certificate (null-byte CN/SAN, wildcard scope), sitemap and framework discovery, Microsoft 365 configuration
- IncludedAuthenticated (logged-in) and headless-browser scanning
Offensive and infrastructure testing
- IncludedNetwork service exploitation (SSH, SMB, RDP, LDAP, SNMP)
- IncludedIntercepting proxy: live feed, request replay and edit, per-host TLS and scope filtering
Verification and intelligence
- IncludedProof-of-exploitation verification on every finding (proven, refuted or unproven)
- IncludedOut-of-band (OOB) callbacks for blind SSRF, XXE and XSS
- IncludedCVE matching with a local NVD mirror plus EPSS and KEV enrichment, and dependency (SCA) checks
- IncludedFull confidence scoring (severity, proof, reachability, EPSS, KEV)
- IncludedInteractive attack-graph view of findings
- IncludedFix verification and baseline scanning (only new issues since a known-good run)
Reporting
- IncludedHTML, PDF and Google Docs reports with executive summary and remediation
- IncludedSARIF (GitHub and GitLab code scanning) and JUnit output
- IncludedCross-scan diff reports, reproduction packages and one-click export to HackerOne and Bugcrowd
CI/CD and integrations
- IncludedCI/CD pipeline command that fails builds on the severities you choose
- IncludedNotifications: email, Microsoft Teams, Google Chat, Pushover and custom webhooks
- IncludedScheduled scans and targeted subscans
- IncludedREST API access, findings query language and endpoint change timeline
Optional AI (your own LLM key)
- IncludedOptional AI triage, asset insight, report drafting and scan planning, using your own LLM key
Platform, scale and audit
- IncludedQuick and standard scan profiles
- IncludedDeep, bounty-hunt and low-noise scan profiles
- IncludedMulti-target scanning and higher concurrency (up to 50 threads)
- IncludedTamper-evident, hash-chained audit trail of every request
Get started with Vexta Pro - Monthly.
Questions before you buy? Free 30-minute call. Fixed quote in 1 business day for anything custom.