ImmuniWeb

Overview

ImmuniWeb is a security platform for organizations assessing applications, APIs and infrastructure, with separate products for scanning, penetration testing and ongoing exposure monitoring. It suits teams that need several of those capabilities together; smaller organizations can start with its no-cost Community Edition. Its breadth is useful, but the paid Discovery and penetration-testing tiers are substantial commitments.

Key features

Scanning and testing

Neuron scans web applications and APIs, including authenticated and scheduled scans, JavaScript crawling, patch verification and OWASP vulnerability checks. Its per-target or per-app subscriptions allow unlimited scans of the same target or app, which makes repeat checks less restrictive than a scan-credit model. On-Demand provides web and API penetration tests with compliance-oriented reporting and remediation assistance. MobileSuite tests mobile apps and can include their backend APIs or web services.

Discovery and integrations

Discovery combines attack-surface management, continuous security monitoring, third-party risk management, dark-web monitoring and threat intelligence. Its packages include dashboard and API access, PDF and XLS exports, JSON through a REST API, and 24/7 expert assistance. Integrations include GitHub Actions, GitLab CI/CD, Azure Pipelines, Jenkins, Jira, Asana, Slack, Splunk, Okta and Microsoft Teams. Discovery also addresses monitoring requirements across frameworks including GDPR, DORA, NIS 2, HIPAA, ISO 27001, SOC 2 and PCI DSS.

Community Edition

The free Community Edition offers online checks for SSL, email security, website security and privacy, mobile app security, and dark-web and threat exposure. That gives SMEs, educational institutions and small municipal governments a way to run basic checks without a subscription; it is not a substitute for the recurring scans, managed monitoring or scoped penetration tests in paid products.

Pricing

Neuron subscriptions are billed by app or target, with unlimited scans of that same app or target. The monthly options cost €395 a month for Neuron Mobile or Neuron; annual options cost €595 a year for either product. The annual price is markedly lower, but the commitment is a poor fit for a short-lived need. Mobile subscriptions cover an Android or iOS app and its builds or versions; standard Neuron subscriptions cover one FQDN target.

Discovery packages have a standard one-year duration and cost €1,495 a month for Dark Web or ASM, €2,495 a month for Corporate Pro, and €4,495 a month for Ultimate. Each covers up to 10,000 assets and/or incidents per company, with additional assets priced flexibly. Corporate Pro includes 25 TPRM vendors and Ultimate includes 100, making those tiers more relevant to companies managing supplier exposure at scale; the Dark Web and ASM packages focus on their respective areas.

On-Demand tests are one-time purchases: Corporate Pro costs €5,995 per penetration test and Ultimate costs €14,995 per penetration test. A test may cover one or several domains, subdomains or APIs. This is a better-shaped purchase for a scoped assessment than a year-long monitoring subscription, though it remains a significant outlay. The Community Edition costs nothing.

Platforms

ImmuniWeb supports web, Android, iOS and API use, with hybrid deployment. The company lists ISO/IEC 27001:2022 among standards addressed on its product pages.

Who it's for

ImmuniWeb is a strong fit for security teams that want repeatable app and API scans alongside monitoring, vendor-risk visibility or expert penetration testing. Its free checks also suit smaller institutions exploring basic exposure. Teams needing only a lightweight scanner, or organizations unable to justify Discovery's annual duration and monthly price, should consider narrower or free alternatives.

Pros and cons

• Pro: Unlimited scans per subscribed app or FQDN make iterative checking practical without a per-scan quota.
• Pro: The product range spans app scanning, mobile testing, penetration tests and attack-surface monitoring, so multiple security needs can sit within one platform.
• Pro: Community Edition provides several useful online checks at no cost.
• Con: Discovery requires a one-year subscription, and its packages start at €1,495 a month.
• Con: On-Demand penetration tests start at €5,995 per test, which may put a focused assessment beyond smaller teams' budgets.

Alternatives

Pentest-Tools.com API Scanner is worth considering for an API-focused tool with a free tier and a NetSec plan from $95 a month, billed with five assets and variable pricing by asset count and billing cycle.

Nuclei is a free, MIT-licensed CLI intended primarily as a standalone tool, while Wapiti is a free, GPL version 2 web application scanner. OWASP ZAP is another free, open-source option for teams that prefer a community-contributed project.

Beagle Security offers a free plan with one lite test per month, surface-scan reports and SSL and domain-expiry monitoring; its Essential tier costs $99 a month, billed annually at 1188 USD. ZeroThreat offers five initial scan credits valid for 15 days, then one scan credit per month and one target per account on its free plan.

Tenable One Attack Surface Management is an alternative for teams evaluating a separate attack-surface management product. Vega is a free option for teams seeking a desktop-based security tool.

For category comparisons, see Web Application Security Scanners, Attack Surface Management Software and Security Ratings Software.

Verdict

Choose ImmuniWeb if your security program needs recurring app or API scanning and may also benefit from monitoring, mobile testing or expert penetration tests in the same platform. The free Community Edition lowers the barrier to basic checks, while unlimited scans per paid target make regular reassessment practical. Look elsewhere if you need only a low-cost standalone scanner or cannot support Discovery's year-long, high-price commitment.