Mayhem

Overview

Mayhem is a software security-testing platform for teams working across code, APIs and software components. It suits security and development teams seeking a single workflow for automated testing and defect investigation. Its breadth is a strong draw, but the API free tier is capped at 50 scans per month and paid API access is $236.00 USD per month.

Key features

Mayhem combines AI-powered, network-aware fuzzing with symbolic execution and intelligent triage. Hybrid input generation and execution, plus coverage guidance and crash triage, make it relevant to teams testing more than API endpoints: targets include Linux and Windows PE binaries, TCP/UDP applications, REST APIs and gRPC APIs. Supported languages include C/C++, Python, Go, Rust and Java.

For code security, Mayhem generates tests autonomously and provides a reproduction and backtrace for each defect. That gives developers material to investigate and reproduce a finding, rather than only an alert. For APIs, it tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis is intended to help teams distinguish components on the attack surface from those that are not.

Integrations span GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Vendor-neutral SARIF reports and real-time notifications suit teams that need to pass findings into existing development and reporting workflows. Enterprise SSO supports SAML, OpenID or OAuth; enterprise customers can also integrate LDAP and Active Directory. Deployment options include managed SaaS, private cloud and closed-network installation, a useful range for organizations with different hosting constraints.

Pricing

The Mayhem for API Free Plan costs 0.00 USD per free and allows up to 50 scans per month. It is a practical starting point for low-volume API testing, but the cap makes it a poor fit for teams that need frequent or broad recurring scans.

Mayhem for API paid plans cost 236.00 USD per month and add scans, enterprise features and personalized support. Paid plans include a free 30-day trial with limits removed, giving teams a chance to evaluate the uncapped API plan before committing. The free tier gives up the additional scans, enterprise features and personalized support; Mayhem also offers enterprise support. Other paid-plan pricing is custom pricing.

Platforms

Mayhem's listed platforms include API, Linux, macOS, self-hosted, web and Windows. Its CLIs run on macOS, Linux and Windows, which gives teams options across common developer environments as well as private and closed-network deployments.

Who it's for

Mayhem is best suited to development and security teams that need to test binaries, networked applications and APIs, and want defect reproductions and backtraces alongside automated discovery. Teams with strict hosting requirements can choose private-cloud or closed-network installation. Small teams focused only on occasional API scans may find the 50-scan free cap sufficient; high-volume use requires paid access.

Pros and cons

• Pros: One dashboard covers code, API and dynamic SBOM security, which suits teams consolidating several testing needs.
• Pros: Reproductions and backtraces help developers investigate defects, while coverage guidance and crash triage support fuzz-testing workflows.
• Pros: Managed, private-cloud and closed-network deployment options accommodate different infrastructure constraints.
• Cons: The free API plan stops at 50 scans per month, limiting its usefulness for sustained or high-volume testing.
• Cons: Paid API access starts at $236.00 USD per month, a meaningful commitment for teams that only need occasional scans.

Alternatives

For a free, open-source option whose production deployment depends on Google Cloud services, consider ClusterFuzz. Choose AFL++ if you want free software under AGPL terms and can work within that license. OSS-Fuzz is a free service for open-source projects, with acceptance requiring a significant user base and/or criticality to global IT infrastructure.

Jazzer offers free coverage-guided, in-process fuzzing for the JVM. Fuzzilli is free Apache-2.0 source code, but requires building the fuzzer and a supported, instrumented JavaScript engine. Choose Schemathesis for a free open-source API testing tool that generates tests from OpenAPI and GraphQL schemas.

EvoMaster is another free option. boofuzz is a free, GPL-2.0 Python library for building fuzzer scripts. Browse Fuzz Testing Software for more tools in the category.

Verdict

Mayhem is a strong fit for security and development teams that need automated testing across code, APIs and exposed software components, particularly when deployment flexibility and actionable defect details matter. Its main reason to choose it is the breadth of testing in one platform; its main reason to look elsewhere is the paid API plan's $236.00 USD monthly price after a free tier limited to 50 scans.