Pricing

An asset in Pentest-Tools.com is a single hostname or IP address that you scan. It's what counts toward your plan limits and billing.

• One asset can have multiple targets (like different URLs for the same domain).

• Subdomains (e.g., app.example.com) and individual IPs in a range are counted as separate assets.

• Scanning an asset once or multiple times still only counts as one scanned asset.

You have full visibility into your scanned assets (including deleted items) and scan history (including deleted items), and we make sure your usage is clear and fair.

We accept debit and credit cards, as well as invoices, wire transfers, and other local payments (terms and conditions apply in accordance with our payment processor).

All payments are processed via FastSpring , which is under contract with PentestTools SA (our legal company name) to process orders and collect payments worldwide.

Yes - flexibility is a core part of our plans.

You can scale your usage in three ways:

• Change how many assets you scan: Add or remove assets anytime. Adding assets apply immediately and you can choose whether the adjustment is for the current billing cycle or ongoing. Removing assets takes effect starting your next billing cycle.

• Adjust your add-ons: Turn specific capabilities (like pentest reports, internal assessments, or branded reports & emails) on or off as needed. Changes take effect just as with assets: if you add an add-on, the change applies instantly; if you remove an add-on, the change applies at the start of your next billing cycle.

• Switch plans (monthly or yearly): You can upgrade or downgrade your plan at any time. Upgrades apply immediately and downgrades apply starting with your next billing cycle.

If you need more assets than our largest tier includes, then please contact our sales team for a custom plan.

Keep in mind: scaling down comes with no penalties, and you can expand your usage at any point, even mid-month. Whether your scope is expanding or you're tightening your focus, the pricing adapts with you.

You can adjust your plan as your needs evolve - with a few details depending on your billing setup:

• Monthly plans can be canceled or changed anytime, with upgrades taking effect immediately, and downgrades applying at the end of your current billing cycle.

• Annual plans have a fixed term, but you can still scale up your usage (like adding assets or features) at any point. You can make full plan changes at renewal.

If you're on an invoice-based or custom plan, just contact our team - we'll walk you through your options and help ensure your setup fits your current scope and workflow.

In case you are not 100% satisfied with the service, there is a 10 day money-back guarantee since your first payment. However, if you decide to continue using the subscription, no further refunds will be granted.

We do not provide refunds for renewals, but you can cancel your subscription at any time from your My account section and you'll still enjoy the full features of the product until the end of the billing period. After your plan expires, you'll still have access to past results and the Free edition of our product.

No. You can run as many scans as you want against the number of scanned assets included in your plan and their targets. Only parallel scans are limited based on the number of scanned assets included in your plan.

Important to know:

• each of the scanned assets can have multiple targets, but we charge by scanned assets

• you can rescan each asset multiple times, we only count it once as a scanned asset

• the number of scanned assets resets monthly in accordance with your plan limit

However, if you want to perform multiple scans in parallel, you can buy more scanned assets for your plan which also increases your parallel scan limit.

Our plan structure is designed to reduce hard limits and give you more control.

You'll only need to switch to a different plan if you want to unlock additional capabilities (like vulnerability exploitation).

But, for most teams, growing usage just means adding more assets or turning on an add-on - not replacing your plan entirely:

• You can scale asset usage instantly from your My account section or via Sales for invoiced accounts. You can choose between 16 and 512+ asset intervals for NetScan and 5 and 500 asset intervals for AppScan and Exploit pricing plans, or request a custom offer for any asset volume larger than that.

• Adding or removing add-ons is just as simple. If you want to add a new add-on, the change takes effect immediately and if you want to remove add-ons, the change applies starting with your next billing cycle.

This gives you more breathing room to test, expand, and adapt without running into frustrating caps or hidden upgrade triggers.

Your scanned asset limit resets automatically at the start of each scan cycle. We remind you that Pentest-Tools.com defines a scan cycle as a monthly period for your scanned asset limit, no matter if you're on a monthly or annual plan.

At the beginning of each new scan cycle, your scanned asset count returns to zero, and you'll have access to your full allocation again. We also email you each month to let you know when this happens.

If you upgrade mid-cycle (for example, to add more assets), the changes apply right away, and your new limits will reset again according to the scan cycle.

Pentest-Tools.com defines a scan cycle as a monthly period for your scanned asset limit, depending on your plan.

For instance, if your plan allows up to 5 scanned assets, we'll count those 5 scanned assets within a month's timeframe and then reset it the following month.

We make a distinction between added assets and scanned assets.

The maximum number of added assets is calculated as a lifetime number in your account. Also, you can always delete old/unused assets to make space for new ones.

The maximum number of scanned assets is the one you chose when you created your account.

We define a scanned asset as such if at least a scan started successfully (no connection error / no VPN error / no failed to start issues). Scanned asset limits reset every month and we email you each time your usage resets to let you know this happens.

Yes - and AI-enhanced capabilities are built into the product, not added on top.

We use AI in specific parts of the continuous scanning and validation workflow where it improves accuracy: to reduce false positives during web application scanning, to expand crawler coverage into deeper application paths, and to handle complex or multi-step login flows during authenticated scans.

Network Scanner results also include AI-enriched vulnerability descriptions to reduce manual triage. Core scanning and validation remain deterministic. AI improves the signal; our engines confirm the risk.

For teams that use AI assistants like Claude or Cursor, our MCP server lets you trigger scans, pull findings, and filter results using natural language - with human approval required for every tool call.

We also offer AI Pentests powered by Specter, our autonomous web app pentesting engine, but these are priced separately from our Continuous Scanning & Validation product.

Data privacy is one of our top priorities.

Our infrastructure is hosted by Linode, whose security practices further strengthen our product — see Linode security.

Starting August 4, 2026, new customers can choose to host their data in the United States or Europe. Existing customers stay in Europe for now, we'll share more on hosting migration options in the upcoming weeks.

All payment data is securely handled by our trusted payment processor, FastSpring. We never store or process your payment details directly. Read all about FastSpring's privacy policy.

Plus, we're fully GDPR compliant and committed to protecting your personal data accordingly.