runZero

runZero is an attack-surface and exposure-management platform for organizations that need visibility across IT, OT, IoT, cloud, mobile, and remote assets. It will suit security teams seeking a unified inventory from several discovery methods; its free edition is aimed at small environments, while enterprise use and console self-hosting require the paid Platform.

Overview

runZero builds a continuously updated inventory by combining active scanning, passive traffic sampling, and API integrations. It records more than devices: services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups are also in scope. That breadth can help teams connect asset discovery to exposure review, though its value depends on the systems and environments an organization needs to cover.

The agentless model avoids deploying agents, configuring authentication, or adding appliances. That reduces collection overhead, but it does not eliminate setup requirements: Explorer binaries for Windows, Linux, and macOS require administrative or root privileges. Deployment can be hosted SaaS or on-premise using Consoles, distributed Explorers, and a command-line tool. The console cannot be self-hosted on the free edition; it requires a Platform license and runZero Care.

Key features

Discovery and inventory

Active scanning, passive sampling, and integrations support hardware, software, cloud, and network asset discovery. Using several methods is a practical advantage in mixed environments where one collection route may leave gaps. Prebuilt integrations cover cloud providers, EDRs, MDMs, vulnerability scanners, ITSM systems, and detection platforms; a Custom Integration API and scripts offer more flexibility. Teams should weigh that breadth against the work of connecting the sources relevant to their own environment.

Risk reporting and alerts

Reports include layer-2 topology maps and asset risk, while alerts can arrive in the product, by email, or through webhooks including Slack. Those options support both network-level review and routing findings into existing workflows, without requiring every team to monitor the console continuously.

Security and support

runZero completed a SOC 2 Type II audit covering the security Trust Service Criteria. It says customer data is logically separated and encrypted at rest and in transit. Documentation, API resources, release notes, a Trust Center, and human support through the console or contact form provide several routes for implementation and ongoing questions.

Pricing

runZero uses a freemium model, with a 21-day trial and paid pricing from $5,000. The Community Edition costs nothing and is capped at 100 assets, one organization, 10 recurring tasks, and 30 days of data retention. It is a sensible starting point for individuals, small businesses, or security researchers who can work within those limits, but the asset and retention caps may constrain longer-running or broader programs.

The runZero Platform costs from $5,000 (priced on request), with the asset limit set by contract, unlimited organizations, projects, and recurring tasks, and three years of data retention. This is the fit for enterprise deployments that need room to scale. Console self-hosting is optional but also requires runZero Care, so teams considering an on-premise deployment should account for that support requirement as well as the license.

Platforms

runZero supports API, Linux, macOS, self-hosted, web, and Windows. Explorer software is available for Windows, Linux, and macOS; installations need administrative or root privileges. The self-hosted option is conditional on a Platform license and runZero Care rather than being a deployment choice available on the free tier.

Who it's for

The Community Edition is designed for small businesses, individuals, and security researchers with 100 or fewer assets. The Platform targets enterprises that need contract-defined asset capacity, more organizations and projects, unlimited recurring tasks, or longer data retention. Organizations that require a self-hosted console also need the Platform and runZero Care. Buyers seeking a free tool for larger inventories or self-hosting without those paid requirements should look elsewhere.

Pros and cons

• Pros: Multiple discovery methods feed one inventory across varied asset types, making the platform suited to complex environments.
• Pros: Prebuilt integrations, a Custom Integration API, and scripts give teams options for bringing other systems into discovery.
• Pros: Risk reports, topology maps, and in-product, email, and webhook alerts connect inventory to review and response workflows.
• Cons: The free tier stops at 100 assets, one organization, 10 recurring tasks, and 30 days of retention, limiting its fit for larger or longer-term programs.
• Cons: Self-hosting the console requires both a Platform license and runZero Care, adding a support requirement to on-premise plans.
• Cons: Explorer installation requires administrator or root privileges, so agentless does not mean setup-free.

Alternatives

Attack Surface Management Software, Exposure Management Software, IT Asset Discovery Software, and Network Discovery Software offer category-level starting points for comparing tools.

• Qualys External Attack Surface Management is worth considering for a 30-day, no-cost CSAM with EASM offer; it has no free plan, unlike runZero's capped Community Edition.
• Bitdefender Total Security is aimed at a different need: its listed individual plan covers five devices for $59.99 a year at the first-year price, plus applicable sales tax.
• FullHunt may suit users seeking a free API or web option with 10 credits per month for evaluation or internal use, rather than runZero's 100-asset inventory tier.
• Ivanti Neurons for Zero Trust Access is another option for buyers evaluating paid, named-user licensing with SaaS deployment.
• ImmuniWeb may fit teams focused on mobile-app scanning: its listed Neuron subscription costs €395 a month per app and allows unlimited scans of builds or versions of the same Android or iOS app.
• Tenable One Attack Surface Management is an alternative for teams seeking unified visibility across IT, cloud, web applications, OT, and external attack surfaces.
• CrowdStrike Falcon Surface is another paid option, with a free trial and demo-based sales process.
• Rapid7 Surface Command is another paid option with a free trial.

Verdict

runZero is a strong choice for security teams that need a broad, continuously refreshed asset inventory assembled from scanning, passive traffic, and integrations. The Community Edition gives smaller environments a useful starting point, while enterprise capacity and self-hosting require the Platform and, for self-hosting, runZero Care. Look elsewhere if those limits or deployment terms do not fit your program.