Overview

runZero combines active scanning, passive traffic sampling, and API integrations to maintain an evolving asset inventory. It records services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups alongside assets, giving teams a wider view of their exposure than host discovery alone. The breadth is a strength when assets span different environments, though the usefulness of integrations depends on connecting the systems a team relies on.

The agentless approach avoids agents, authentication, and appliances, reducing deployment friction. It does not eliminate setup requirements: Explorer binaries for Windows, Linux, and macOS require administrative or root privileges. Organizations can use hosted SaaS or deploy on-premise Consoles with distributed Explorers and a command-line tool. Console self-hosting is an enterprise commitment, requiring both a Platform license and runZero Care.

Key features

Discovery and inventory

Active scanning, passive sampling, and integrations support hardware, software, cloud, and network asset discovery. This mix suits environments where one collection method would leave gaps. Prebuilt integrations cover cloud providers, EDR and MDM products, vulnerability scanners, ITSM systems, and detection platforms; a Custom Integration API and scripts provide another route when a prebuilt connector is not enough.

Risk visibility and response

Reports include layer-2 topology maps and asset risk, while alerts can arrive in-product, by email, or by webhook, including Slack. These options help teams turn inventory findings into operational follow-up without relying on a single notification channel. The inventory also tracks vulnerabilities and certificates, adding context to the asset list.

Security and support

runZero has completed a SOC 2 Type II audit covering the security Trust Service Criteria and says customer data is logically separated and encrypted in transit and at rest. Documentation, API resources, release notes, a Trust Center, and human support through the console or contact form provide support routes for deployment and ongoing use.

Pricing

runZero uses a freemium model, with a 21-day trial and paid plans from $5,000. The Community Edition is 0.00 USD per free and caps usage at 100 assets, one organization, 10 recurring tasks, and 30 days of data retention. It is a practical starting point for individuals, security researchers, and small businesses within those limits, but the asset and organization caps constrain broader or multi-team deployments.

The runZero Platform is 5000.00 USD per contact, with an asset limit set by contract, unlimited organizations, projects, and recurring tasks, and three years of data retention. It is designed for enterprises that need room to scale beyond the free edition’s fixed caps. The price is a contact-based starting point rather than a self-serve per-seat rate; the plan has no published seat quota. Self-hosted console use is optional but requires runZero Care to be explicitly enabled in addition to the Platform license.

The cheaper Community Edition gives up the Platform’s unlimited organizations, projects, and recurring tasks, along with its longer retention period and contractual asset limit. Teams that need self-hosting cannot use the free tier for that purpose.

Platforms

runZero supports API, Linux, macOS, self-hosted, web, and Windows. Explorer binaries are available for Windows, Linux, and macOS, with administrative or root privileges required for installation. The self-hosted option is subject to the Platform-and-Care requirement.

Who it's for

The Community Edition is aimed at small businesses, individuals, and security researchers with 100 or fewer assets. The Platform is built for enterprises, particularly those that need inventory across several asset classes, longer retention, or many organizations and projects. It is a less suitable fit for a small environment that exceeds the free tier’s task, organization, or asset caps but does not need an enterprise license.

Pros and cons

Pros: Multiple discovery methods combine into one evolving inventory, helping cover mixed IT, OT, IoT, cloud, mobile, and remote environments.
Pros: Prebuilt integrations, a Custom Integration API, reports, and several alert channels connect discovery with existing security and IT workflows.
Pros: The free edition gives qualifying small environments a defined way to begin, without a paid commitment.
Cons: The free edition is capped at 100 assets, one organization, 10 recurring tasks, and 30 days of retention, which may be restrictive as deployment scope grows.
Cons: Self-hosting the console requires both the Platform license and runZero Care, so it is not an inexpensive alternative to hosted use.
Cons: Explorer installation requires administrative or root privileges despite the agentless collection model.

Alternatives

Attack Surface Management Software, Exposure Management Software, Network Discovery Software, and IT Asset Discovery Software are useful category lists for comparing tools by the problem a team is trying to solve.

Qualys External Attack Surface Management is worth considering for a 30-day no-cost CSAM with EASM offer; unlike runZero, it has no free plan and does offer a trial.
FullHunt is a more focused option for users who can work within its Free plan’s 10 monthly credits and evaluation or internal-use restriction, or its $149.00 USD Builder plan.
Bitdefender Total Security is a different choice for individual device security: its Total Security Individual plan is 59.99 USD per year for the first year, plus applicable sales tax, covering five devices and one account.
ImmuniWeb is an alternative for teams looking at mobile application scanning; its Neuron Mobile monthly subscription is 395.00 EUR per month per app for unlimited scans of builds or versions of the same Android or iOS app.
Censys Attack Surface Management uses asset-based pricing with a quote required, making it a candidate for teams seeking a paid, web-based option and willing to request pricing.
Check Point External Risk Management is another paid option, with Windows, macOS, and Linux support.
Ivanti Neurons for Zero Trust Access is a paid alternative with broad platform support, including mobile, desktop, web, and self-hosted deployments; its named-user licensing is contact-based.
Outpost24 Attack Surface Management offers custom pricing shaped around cybersecurity goals, teams, and timelines, and has no free plan.

Verdict

runZero is a strong choice for security teams that need a continuously updated inventory across diverse asset types and want active, passive, and integration-based discovery in one platform. The Community Edition is a sensible fit within its strict small-environment caps; enterprises gain broader limits and longer retention with Platform. Look elsewhere if those caps do not fit but an enterprise license is out of reach, or if self-hosting is a priority without the additional Platform and Care commitment.

	iStumbler	runZero
Free plan	No	Yes
Free trial	No	Yes
Paid from	—	Free
Open source	No	No
Platforms	macOS	api, Linux, macOS, self-hosted, Web, Windows
Free plan	No	Yes
Discovery method	agentless	—
Asset inventory	Yes	—
Network scope	local	—

iStumbler vs runZero

iStumbler

runZero