ZeroThreat

Overview

ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs. It suits teams that need repeatable scans, authenticated testing, and actionable exploit evidence; its target-based subscription is less suited to occasional tests across many applications.

Key features

ZeroThreat pairs vulnerability discovery with reproducible proof: findings include request-and-response evidence and exact payloads. That can help security teams verify what a flaw does and give developers a concrete starting point for remediation.

Web testing supports authenticated workflows, SSO, MFA, role-based access, and browser rendering for React, Vue, and Angular single-page applications. API coverage includes REST, GraphQL, SOAP, and gRPC, and addresses internal APIs, shadow endpoints, BOLA, and BFLA. ZeroThreat says its coverage spans more than 130,000 vulnerabilities, including OWASP, CWE/SANS, Nuclei, and regularly updated CVE intelligence.

Scheduled scans and unlimited retesting are included in Professional, while authenticated scans, JavaScript crawling, API scanning, and compliance reports are listed as capabilities. Integrations cover CI/CD tools such as GitHub Actions, GitLab, Jenkins, Azure Pipelines, CircleCI, and AWS CI/CD, as well as Jira, Asana, Slack, and Microsoft Teams. Native connectors, APIs, and webhooks offer different routes to connect; guided setup is no-code, with API or CLI customization for teams that need it.

ZeroThreat describes controls including IAM, MFA, network segmentation, TLS 1.3 in transit, Azure Key Vault encryption at rest, and continuous monitoring. It states compliance with GDPR, HIPAA, and PCI DSS, and alignment with ISO 27001 guidelines. On-premises, air-gap-ready deployment is offered for organizations seeking full data sovereignty. Scans typically take 30 minutes to two hours, and can start within minutes.

Pricing

The Free plan costs nothing. Sign-up includes five scan credits valid for 15 days, then one scan credit per month, one target per account, and a limited vulnerability-insights preview. It covers web applications and APIs, making it useful for a small initial evaluation, but the monthly credit and single-target cap are restrictive for ongoing or broader testing.

Professional costs $100 a month, billed monthly. It includes target-based unlimited scans, scheduled scans, 130K+ vulnerability coverage, unlimited retesting, and a 30-day target-URL cooling period. Additional targets cost $75 each, so the base price is most compelling for teams focused on one target; the annual option saves 20%. The target-based structure and cooling period matter if your work spans multiple applications or requires frequent target changes.

Pay Per Scan costs $125, paid once, billed in five credits, with credits valid for one year and volume discounts up to 20%. It offers unlimited targets, a seven-day unlimited retest window, and point-in-time compliance reporting. This is a better fit for intermittent projects across multiple targets, but it does not provide Professional's ongoing scheduled scans. A free trial is also offered.

Platforms

ZeroThreat supports web and API testing. Its web workflows cover modern JavaScript applications, and its API testing includes multiple API styles; on-premises air-gap-ready deployment is an option for organizations requiring full data sovereignty.

Who it's for

ZeroThreat is aimed at enterprise security teams, DevOps and security teams, SaaS companies, developers, MSSPs, and startups. It is strongest for teams that can make use of authenticated web and API scans, integrate testing into delivery workflows, and act on exploit-level evidence. A single-target Professional subscription fits continuous testing of one application; occasional testing across many targets points instead to Pay Per Scan. The Free plan is better treated as a limited starting point than a substitute for sustained coverage.

Pros and cons

• Pros: Reproducible request/response evidence and exact payloads make findings more verifiable and useful for remediation.
• Pros: Authenticated web testing and coverage across REST, GraphQL, SOAP, and gRPC support varied application environments.
• Pros: CI/CD, issue-tracking, and messaging integrations give teams several ways to connect scans to existing workflows.
• Cons: Free use is capped at one target and one monthly credit after the initial five credits expire, limiting recurring evaluation.
• Cons: Professional's $75 additional-target charge makes expanding beyond its base target materially more expensive.
• Cons: Pay Per Scan's seven-day retest window is shorter than Professional's unlimited retesting, making it less suited to continuous remediation cycles.

Alternatives

For a free, open-source option that anyone can contribute to, choose OWASP ZAP; it covers API testing and runs on Linux, macOS, Windows, and self-hosted environments. Choose Burp Suite DAST if you want a tailored paid solution for a portfolio, with pricing dependent on that portfolio. Beagle Security is another freemium web and API option: its Free plan includes one lite test per month, monthly surface-scan reports, and SSL and domain-expiry monitoring.

Escape is a paid web and API alternative with custom pricing scoped to your environment, available through AWS Marketplace or channel partners. Astra Security offers a Scanner Lite plan at $69 a month for one target, three monthly scans, 15,000+ tests, and one integration; choose it when those limits fit your scanning needs. Nuclei is a free, MIT-licensed open-source CLI primarily intended as a standalone tool, rather than a hosted platform. ImmuniWeb is an alternative with Android, iOS, web, and API platforms. Wapiti is a free and open-source scanner under GNU GPL version 2.

Compare more tools in Web Application Security Scanners and API Security Testing Software.

Verdict

Choose ZeroThreat if your team needs ongoing web and API penetration testing with authenticated workflows and reproducible exploit evidence, especially when scans belong in a delivery pipeline. Its broad testing coverage and integrations are compelling, but the target-based subscription and add-on cost make it a weaker fit for many-target programs on a tight budget. For intermittent work across many targets, Pay Per Scan offers more flexibility; for continuous testing, weigh Professional's target limits against your actual scope.