Blacklock
Blacklock is a cloud Penetration Testing as a Service platform available through a web interface, API, and browser extension.
What Blacklock is
Blacklock is a cloud Penetration Testing as a Service platform available through a web interface, API, and browser extension. It combines automated vulnerability discovery, manual security testing, and vulnerability management. Scheduled or on-demand scans cover infrastructure, web applications, and REST APIs, including authenticated areas. CREST-certified security consultants perform manual penetration tests and return findings in real time or as tickets. Static code analysis supports more than 30 languages and scans repositories on request or on a schedule. The service analyzes uploaded or scanned SBOMs and exports findings as PDF, SPDX, or CycloneDX. Reports include executive, developer, and full penetration-test versions, along with a certificate. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Vanta, Microsoft Entra ID, Okta, SSO/SAML, Zapier, and Salesforce. Blacklock lists encryption in transit and at rest and support for PCI, ISO 27001, SOC-2, HIPAA, and GDPR.
Good
- Scheduled and on-demand infrastructure, web, and API scans
- Manual testing by CREST-certified security consultants
- Static analysis supports more than 30 languages
- SBOM exports include PDF, SPDX, and CycloneDX
- 14-day fully featured trial available
Watch out
- No free plan
- Manual testing price depends on application scope
- Cloud deployment requires web, API, or extension access
Who it suits
Blacklock suits organizations needing recurring infrastructure, application, API, or code security checks. It is also aimed at teams seeking consultant-led penetration testing and compliance-oriented reporting.
Verdict
Blacklock combines automated scanning with consultant-led penetration testing, code analysis, and SBOM review. Its broad integrations and compliance reports suit organizations managing several security workflows, while pricing and manual-test scoping require contacting the provider for some services.
Plans and prices
From Blacklock's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Vulnerability Scanning | $85 a month | Unlimited scheduled and on-demand scans · Agentic AI vulnerability validation and retesting · Blacklock API access · Starts at USD 85 per month; tiered pricing |
| Manual Penetration Testing | Priced on request | CREST-certified manual testing · Three reports and a penetration test certificate · Pricing depends on application size and complexity, assessed during scoping |
The facts
Each one read from Blacklock's own pages, with the date it was checked.
Where it runs
- Browser extension
- The site describes a Navigate & Scan browser plugin for capturing authentication cookies to scan login-protected areas.checked 4 Oct 2026
The company
- Headquarters
- Wellington, New Zealandchecked 28 Sep 2026
What it does
- Integrations
- The site lists GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Vanta, Microsoft Entra ID, Okta, SSO/SAML, Zapier, and Salesforce integrations.checked 4 Oct 2026
- Intended customers
- The company says its mission is to make consultant-grade penetration testing available to organizations of all sizes.checked 4 Oct 2026
- Penetration testing
- CREST-certified security consultants perform manual penetration tests and deliver findings in real time or as tickets.checked 4 Oct 2026
- Reporting
- Penetration testing includes executive, developer, and full penetration test reports, plus a penetration test certificate.checked 4 Oct 2026
- SBOM
- Blacklock analyzes uploaded or scanned SBOMs and exports findings as PDF, SPDX, or CycloneDX.checked 4 Oct 2026
- Scanning
- The platform provides scheduled and on-demand vulnerability scanning for infrastructure, web applications, and REST APIs.checked 4 Oct 2026
- Security and compliance
- Blacklock says sensitive data is encrypted in transit and at rest, and lists PCI, ISO 27001, SOC-2, HIPAA, and GDPR among the standards its services support.checked 4 Oct 2026
- Static code analysis
- Static code scanning supports more than 30 languages and can scan repositories on a schedule or on demand.checked 4 Oct 2026
- Support
- The site provides a contact email and says it will respond to an inquiry within 24 hours.checked 4 Oct 2026
- What it does
- Blacklock is a cloud-first Penetration Testing as a Service platform combining automated vulnerability discovery with manual security testing and vulnerability management.checked 4 Oct 2026
Money
- Trial
- Blacklock offers a fully featured 14-day free trial.checked 4 Oct 2026
Alternatives to Blacklock
- 1
OWASP ZAP
Free planOpen sourceAPIExtensionLinuxmacOS7.6Free plan - 2
Beagle Security
Free planWebAPI6.9From $99 a month - 3
ImmuniWeb
AndroidiOSWebAPI6.8From €595 a year - 4
Nuclei
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 5
ZeroThreat
Free planWebAPI6.7From $100 a month - 6
VAddy
WebAPILinuxmacOS6.6From ¥19,800 a month