17.9
AttackIQ Platform is a continuous threat exposure management platform for modeling adversary behavior, finding attack paths, validating security…
Free planWebAPILinux
Alternatives to vPenTest
27.6
Kali Linux is a Debian-based distribution for advanced penetration testing and security auditing.
Free planOpen sourceAndroidLinuxmacOS
37.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
- 4
ImmuniWeb
ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure.
AndroidiOSWebAPI6.8From €595 a year - 5
Astra Security
Astra Security describes its product as a continuous penetration testing platform for web applications, APIs, and cloud infrastructure.
WebAPI6.5From $699 a year - 6
Pentest-Tools.com API Scanner
Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion,…
WebAPILinuxmacOS6.5From $95 a month - 7
Atomic Red Team
Atomic Red Team is a free library of security tests for checking whether security controls provide visibility and detect adversary behaviors.
Free planAPILinuxmacOSWindows6.2Free plan - 8
Picus Security Platform
Picus Security Platform helps security teams validate attack surfaces, exposures, and security controls so they can prioritize risks and remediation.
WebAPILinuxmacOS6.1 - 9
SCYTHE
SCYTHE is a continuous Adversarial Exposure Validation platform for enterprise security teams.
WebLinuxSelf-hostedWindows6.1 - 10
Stratus Red Team
Stratus Red Team is a self-contained Go binary for running focused offensive techniques against live cloud environments to validate detections.
APILinuxmacOSSelf-hosted6.0 - 11
BlackArch Linux
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers.
Free planLinuxSelf-hosted5.9Free plan - 12
BreachLock DAST
BreachLock DAST checks running applications from the outside by sending inputs and analyzing their responses.
WebAPIExtension5.9From $5,000 a year - 13
NodeZero
NodeZero is a security platform that autonomously runs penetration tests to find exploitable attack paths, guide remediation, and verify fixes.
WebAPILinuxSelf-hosted5.9 - 14
Cymulate Platform
Cymulate Platform continuously validates security controls against real-world threats and provides guidance for improving defenses.
Web5.8 - 15
Metasploit Pro
WebLinuxWindows4.9 - 16
Burp Suite Professional
LinuxmacOSWindows4.7 - 174.7
- 18
Metasploit
LinuxmacOS4.7 - 19
Social-Engineer Toolkit (SET)
LinuxmacOSWindows4.7 - 204.6
- 21
Core Impact
Windows4.6