ZeroThreat

ZeroThreat is an autonomous penetration-testing service for web applications and APIs. It is a strong fit for development and security teams that need authenticated, repeatable scans with evidence developers can act on. The main trade-off is capacity: the free allowance is brief and tightly capped, while paid plans tie economics to targets or scan credits.

Overview

ZeroThreat continuously searches for vulnerabilities, attempts exploitation, and validates the result rather than stopping at a detection. Its strongest practical differentiator is proof that can be reproduced: each finding can include request and response evidence plus the exact payload used. That gives a security reviewer a way to confirm impact and gives an engineer a more concrete remediation starting point.

The service is delivered for web and API targets, with a U.S.-based company behind it. Scan jobs generally start within minutes and finish in about 30 minutes to two hours, depending on the application. A Help Center covers setup, quick scans, authenticated scans, and login sequences.

Key features

Web testing handles authenticated workflows, SSO, MFA, role-based access, and browser-rendered React, Vue, and Angular single-page applications. This makes it more suitable than a basic unauthenticated crawler for modern applications whose meaningful functionality sits behind login or JavaScript navigation.

API testing spans REST, GraphQL, SOAP, and gRPC, including internal APIs and shadow endpoints. Coverage includes business-logic problems such as broken object-level and broken function-level authorization (BOLA and BFLA), not only conventional perimeter checks.

ZeroThreat says its library covers more than 130,000 vulnerabilities, drawing on OWASP, CWE/SANS, Nuclei, and monthly updated CVE intelligence. Authenticated scans, JavaScript crawling, scheduled scans, API scanning, and compliance reports are listed capabilities; scheduled scans and unlimited retesting are specifically included in Professional.

Integrations reach GitHub Actions, GitLab, Jenkins, Azure Pipelines, CircleCI, TeamCity, AWS CI/CD, Bamboo, and Travis CI, plus Jira, Asana, Slack, and Microsoft Teams. Native connectors, APIs, and webhooks provide deployment choices, while guided no-code setup is available alongside API or CLI customization. The stated security architecture includes IAM, MFA, network segmentation, TLS 1.3 in transit, Azure Key Vault encryption at rest, and continuous monitoring. ZeroThreat says it complies with GDPR, HIPAA, and PCI DSS, aligns controls with ISO 27001 guidance, and offers air-gap-ready on-premises deployment for data sovereignty.

Pricing

Free — free. Sign-up provides five scan credits valid for 15 days, then one scan credit per month. The account is limited to one target and a limited vulnerability-insights preview, although web applications and APIs are supported. This is useful for evaluating the workflow or running occasional checks, not for maintaining coverage across several assets.

Professional — $100 a month, billed monthly; an annual option saves 20%. It includes target-based unlimited scans, scheduled scans, more than 130,000-vulnerability coverage, unlimited retesting, and a 30-day target-URL cooling period. Additional targets cost $75 each. This is the logical plan for a team repeatedly scanning a stable set of applications; the per-target charge makes a broad, fast-changing portfolio more expensive.

Pay Per Scan — $125, paid once, billed as five credits. Credits remain valid for one year, volume discounts reach 20%, and the plan allows unlimited targets, a seven-day unlimited-retest window, and point-in-time compliance reporting. It better suits consultants or teams with irregular projects, though repeated scans can exceed the predictable cost of Professional.

Platforms

ZeroThreat supports web and API environments. On-premises deployment is described as air-gap ready, which is relevant when scan data must remain under an organization's control.

Who it's for

Enterprise security groups, DevOps and application-security teams, SaaS companies, developers, managed security providers, and startups are the stated audiences. Professional fits teams with recurring targets and CI/CD integration needs. Pay Per Scan is a better match for episodic assessments across many targets. The Free plan is primarily an evaluation path because its one-target cap and short initial credit window restrict ongoing use.

Pros and cons

Pros

• Reproducible exploit evidence: request/response records and exact payloads make findings easier to verify and remediate.
• Deep authenticated coverage: SSO, MFA, roles, login sequences, and JavaScript rendering address complex modern applications.
• Broad API scope: REST, GraphQL, SOAP, gRPC, internal, and shadow APIs are covered, including BOLA and BFLA.
• Workflow connectivity: extensive CI/CD, ticketing, and messaging integrations can feed existing delivery processes.
• Deployment controls: air-gap-ready on-premises deployment and stated enterprise security controls support sovereignty requirements.

Cons

• Very small free allowance: five credits expire after 15 days, followed by one credit monthly and one target per account.
• Professional scales by target: each additional target adds $75 per month, which can penalize larger portfolios.
• Pay Per Scan is costly for frequent use: $125 buys five credits, even though credits last a year.

Alternatives

For a broader shortlist, compare Web Application Security Scanners and API Security Testing Software.

Nuclei is free, open-source, and primarily a standalone CLI for Linux, macOS, Windows, or self-hosting; choose it when you want that model rather than a managed autonomous platform.

OWASP ZAP is free and open source across API, desktop, and self-hosted environments, making it a fit when community-contributed tooling matters.

Wapiti is another free, GPL-licensed open-source scanner for API, desktop, and self-hosted use.

Beagle Security offers a free lite test each month with surface reports and SSL/domain monitoring, while its Essential plan is $99.00 per month billed annually; choose it when monitoring is central.

Detectify Surface Monitoring suits teams focused on external-surface monitoring and annual platform plans.

Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM trial for teams evaluating an enterprise exposure-management suite.

ImmuniWeb is aimed at organizations needing mobile application coverage alongside web and API options.

Pentest-Tools.com API Scanner starts its NetSec plan from $95 per month with five assets and combines API-related work with network and cloud scanning.

Verdict

Choose ZeroThreat if your team needs continuous web and API penetration testing, authenticated application coverage, and exploit evidence that developers can reproduce. Professional is the best fit for recurring scans on a defined target set; Pay Per Scan is more sensible for occasional, multi-target engagements. Look elsewhere if you need a genuinely open-ended free scanner or if your portfolio makes per-target subscription charges unattractive.