Mayhem

Mayhem is a security-testing platform that brings code, APIs and dynamic software-bill-of-materials analysis into one operating view. It is best suited to development and security teams that need automated fuzzing in CI/CD as well as API and dependency reachability checks. The broad target support is a strength, but the free API allowance is modest and the main paid plan is a substantial monthly commitment.

Overview

Mayhem focuses on finding exploitable defects rather than merely cataloguing them. Its autonomous test generation produces a reproduction and backtrace for each code finding, while hybrid fuzzing, symbolic execution and triage are combined in the same workflow. That makes results more actionable for engineers who must reproduce and fix failures.

The API product tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis is aimed at separating components that can actually be reached on an attack surface from dependencies that cannot. Together, these capabilities give teams a wider security view than an API-only fuzzer, though they also imply a product best operated by teams with established security processes.

ForAllSecure, founded in 2012 and headquartered in Pittsburgh, makes Mayhem with a stated mission of automatically testing and protecting software.

Key features

Hybrid fuzzing for varied targets

Input generation and execution are both hybrid, combining AI-powered, network-aware fuzzing with symbolic execution. Coverage guidance and crash triage help direct effort toward new code paths and sort failures. Mayhem targets Linux binaries, Windows PE binaries, TCP/UDP applications, REST APIs and gRPC APIs, so it can cover native software and network services alongside web interfaces.

Actionable code and API findings

Autonomously generated code tests come with a reproduction and backtrace, giving developers concrete material for debugging. API testing is stateful and agentless and is explicitly aligned with the OWASP Top 10 for APIs, which suits teams assessing multi-step API behavior rather than isolated requests.

SBOM, reporting and workflow connections

Reachability analysis is useful when a dependency inventory is too broad to prioritize: it focuses attention on components that are exposed to attack. Vendor-neutral SARIF reports support security-tool pipelines, while real-time notifications surface findings quickly. Integrations include GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI, making Mayhem a practical fit for teams already using those systems.

Enterprise authentication can use SAML, OpenID or OAuth for SSO, with LDAP and Active Directory integration for enterprise customers. Deployment options span managed SaaS, private cloud and closed networks. The command-line tools run on macOS, Linux and Windows, and CI/CD support is included.

Pricing

The free plan is a sensible way to evaluate API testing or to cover a small, lower-frequency service, but 50 scans per month can be restrictive for busy teams or broad endpoint inventories. The paid plan removes the trial limits and adds additional scans, enterprise capabilities and personalized support, making it the more appropriate tier for production programs that need scale or organizational controls. Paid plans include a free 30-day trial; after that, the published price is $236 a month. The broader Mayhem offering uses pricing on request, so teams seeking enterprise-wide terms should expect a custom quote rather than assuming the API price covers every deployment or capability.

Platforms

Mayhem is offered through web and API access and supports Linux, macOS and Windows command-line environments. Self-hosted deployment is supported, alongside managed SaaS, private-cloud and closed-network installations. This range suits organizations with regulated or isolated environments, while the CLI coverage allows security checks to run in common developer workstations and pipelines.

Who it's for

Choose Mayhem if your team wants one platform for binary fuzzing, network-service testing, API security and dynamic SBOM prioritization, especially when CI/CD integration and enterprise identity controls matter. It is also a strong fit for organizations that need reproducible crash evidence and deployment choices beyond public SaaS.

It is less compelling for a small API project that will remain below 50 monthly scans and does not need enterprise features; the free tier may be enough, while the paid price is difficult to justify for occasional testing. Teams seeking only a standalone open-source fuzzer may prefer a simpler tool and accept more responsibility for assembling reporting, triage and workflow integrations.

Pros and cons

• Pros: One dashboard covers code, API and dynamic SBOM security.
• Pros: Hybrid fuzzing with symbolic execution, coverage guidance and crash triage can produce more useful investigations than alerts alone.
• Pros: Reproductions, backtraces, SARIF reports and broad CI/CD integrations support remediation workflows.
• Pros: SaaS, private-cloud and closed-network deployment options accommodate different operational constraints.
• Cons: The free API plan stops at 50 scans per month.
• Cons: Paid API access costs $236 a month, before any custom enterprise terms.
• Cons: The breadth of targets and enterprise controls may be unnecessary overhead for teams wanting a narrowly focused, open-source fuzzer.

Alternatives

ClusterFuzz is the better choice when you want free, Apache-2.0-licensed software and can provide the Google Cloud services required for production deployment.

Accessibility Test Framework for Android fits teams specifically validating Android accessibility rather than broad application security.

AFL++ is a free, AGPL-licensed option for teams prepared to run and maintain an open-source fuzzer across its supported platforms.

cargo-fuzz suits Rust-focused projects wanting a free tool under MIT and Apache licensing.

Fuzzinator is a free option with no paid plans or stated usage limits.

boofuzz is appropriate when you want a free Python library for building fuzzer scripts.

EvoMaster offers a free open-source approach with no paid external services required.

EvoMaster is another free, open-source choice when avoiding paid external services is the priority.

Verdict

Mayhem is a strong choice for organizations that need code, API and dependency reachability testing tied to developer workflows, with reproducible findings and flexible deployment. Choose it when that breadth and enterprise integration justify the cost; look elsewhere if you need only occasional API scans or a lightweight free fuzzer.