How many credits does each pentest cost?
| Web app or API, grey-box | 1 credit |
|---|---|
| MCP server or AI system | 1 credit |
| Multi-app or cloud scope | 2 credits |
| Active Directory | 2 to 3 credits |
| Re-test of a finding | Free |
PRICING · CREDITS, NOT ASSETS
Buy pentests. The platform comes with them.
Every plan is a volume of pentest credits, cheaper the more you commit. Hortense, attack-surface monitoring, re-tests, EU hosting, compliance and support are included in every plan.
| Plan | Free€0self-serve | Pentest€4,000one-off | FIRST YEARLY PLANEssential€12,000per year | Continuous€25,000per year | Posture€50,000per year | CustomOn quotegroups, MSSPs |
|---|---|---|---|---|---|---|
| Pentest credits | None | 1 | 3 | 7 | 15 | 20+ |
| Price per credit | Not included | €4,000 | €4,000 | €3,571 · −11% | €3,333 · −17% | from €2,800 |
| Platform access | Ongoing | 90 days | Annual | Annual | Annual | Annual, multi-entity |
| Repositories | 10 | 3 | 50 | 200 | 1,000 | Unlimited |
| Hortense | Not included | Single report | Full | Full | Full | Full, rolled up by entity or subsidiary |
| Modules | Scanners | Web & API | Web & API | Web & API, Active Directory, MCP servers | All, including cloud and infrastructure | All |
| Re-tests | Not included | Unlimited for 90 days | Unlimited | Unlimited | Unlimited | Unlimited |
| Start free | Buy a pentest | Book a demo | Talk to us | |||
€4,000 per pentest, against €15,000 to €30,000 for a consulting firm.
Starting with one pentest? It is credited in full against a yearly plan taken within 60 days.
RULES · SAME FOR EVERY PLAN
How credits work.
What a credit buys, what happens when you run out, and what every plan includes.
What if I need more credits?
Each extra credit is €4,000, whatever your plan. Moving up a plan always beats repeated top-ups.
Do unused credits roll over?
No. Credits are valid for the subscription year and do not carry over to the next one.
What comes with every plan?
- Hosting and inference in Europe (Scaleway, Paris), full isolation between clients
- Continuous attack-surface discovery
- A replayable PoC on every finding, and a signed audit-ready report in PDF and JSON
- Traceability mapped to DORA, NIS2 and ISO 27001
- Onboarding and support
GET STARTED · 30 MINUTES
Run your first pentest this week.
30 minutes with a founder. You describe your perimeter, we run the platform against it live, and you leave with a priced scope and a delivery date.
30 MIN · CET · NDA-READY