Our take: Choose ZeroThreat if you need automated web and API pentesting with compliance reports, starting free or at $100 per target per month.
Main limitation: The free plan covers only one target and shows just a preview of results, and Professional is priced per target.
By the AI Tool Atlas editors.
Based on the vendor's official documentation; we have not tested this product hands-on. What “documented overview” means
Is ZeroThreat right for you?
Choose ZeroThreat if you need automated web and API pentesting with compliance reports, starting free or at $100 per target per month. Based on the vendor's documentation, not on a hands-on test.
Best for: Security teams
Also a good fit for
Developers testing web apps and APIs
Consider another tool if free plan limited to 1 target and a preview of results
Or if
Professional priced per target ($100 base, $75 each additional)
Pay-per-scan retest window is 7 days
ZeroThreat pricing and usage limits
Prices checked Oct 4, 2026 on the official US pricing page. Official pricing ↗ Prices and limits change often.
The official ZeroThreat pricing page as we saw it. zerothreat.ai, captured Oct 2, 2026
ZeroThreat is an automated pentesting tool for web applications and APIs. It states it detects 130K+ vulnerabilities, supports authenticated scans and API testing (REST, GraphQL, SOAP, gRPC).
It adds AI remediation guidance, executive summaries and audit-ready reports for GDPR, ISO27001, PCI-DSS and HIPAA.
ZeroThreat's official site: how the product presents itself. zerothreat.ai, captured Oct 2, 2026
What you provide and what you get back
What you give ZeroThreat and what comes back, from its documentation
You provide
Target web app or API
Authentication details
You get back
Vulnerability findings
Remediation guidance and compliance reports
Where you can use it
Account
Required
Targets
Web apps, APIs
Protocols
REST, GraphQL, SOAP, gRPC
Reports
GDPR, ISO27001, PCI-DSS, HIPAA
Credit validity
1 year
Where ZeroThreat is most useful
Scenarios are worked out by our editors from the documentation; the actual result depends on your input and plan.
Web app pentesting
Who
Security teams
You provide
A web app URL
Expected result
ZeroThreat returns a list of findings for the web app, with remediation guidance.
ZeroThreat produces an audit-ready report from a scan that the compliance lead can share.
Plan needed
Free
Limitation
The reports cover GDPR, ISO27001, PCI-DSS and HIPAA, so other frameworks are not stated. source (opens in a new tab)
ZeroThreat features and their limits
Feature overview on the official site. zerothreat.ai, captured Oct 2, 2026
130K+ vulnerability coverage
Checks against a very large vulnerability base. Security teams get a wide check without writing tests by hand, though the number is the vendor's own claim.
Access: Not statedLimit: The 130K+ figure is stated by the vendor and was not independently checked.source (opens in a new tab)
Authenticated scanning
Tests behind logins. Teams can test pages that sit behind a login, which many real web apps need.
Access: Not statedLimit: Authenticated scans need login details to be set up before the scan.source (opens in a new tab)
API pentesting
Tests REST, GraphQL, SOAP and gRPC. Developers can test REST, GraphQL, SOAP and gRPC interfaces with the same tool.
Access: Not statedLimit: Coverage is limited to the four protocols named on the site.source (opens in a new tab)
AI remediation and executive summaries
Explains how to fix and summarises for executives. Teams without a security specialist get fix guidance and a summary that managers can read.
Access: Not statedLimit: The guidance is generated by AI, so a person should check it before acting.source (opens in a new tab)
Pros, cons and deal-breakers
Where ZeroThreat is strong
Free plan with 1 scan credit per month The free plan includes one scan credit per month, so you can run a first scan on one target at no cost.documentedsource (opens in a new tab)
Pay-per-scan option with 1-year credit validity Pay-per-scan credits stay valid for one year, so occasional testers do not need a monthly subscription.documentedsource (opens in a new tab)
Volume discounts up to 20% on credits Credit volume discounts reach 20 percent, so teams that buy many scans pay less per scan.documentedsource (opens in a new tab)
Unlimited retesting on Professional The Professional plan includes unlimited retesting, so you can check that a fix worked without paying for another scan.documentedsource (opens in a new tab)
Limitations to check before paying
Free plan limited to 1 target and a preview of results The free plan covers one target and shows only a preview of results, so you cannot read the full findings without paying.documentedsource (opens in a new tab)
Professional priced per target ($100 base, $75 each additional) Professional costs $100 per month for the first target and $75 for each extra one, so the price grows with every app or API you add.documentedsource (opens in a new tab)
Pay-per-scan retest window is 7 days Retests on pay-per-scan are allowed for only 7 days, so slow fixes may need a new paid scan to be verified.documentedsource (opens in a new tab)
Account required An account is required, so you cannot run a scan without registering first.documentedsource (opens in a new tab)
How to use ZeroThreat for automated web and API pentesting
Set up ZeroThreat
Create a ZeroThreat account.
Add a target.
Provide credentials for authenticated scans.
Example: automated web and API pentesting
Launch a scan.
Review findings.
Apply fixes and retest.
Review and export the result
Confirm findings manually.
Export the report.
Privacy, data use and commercial rights
Summarized from the vendor's current policies; this is not legal advice and a vendor's badge is not an independent audit.
How your inputs and outputs are handled
Scan targets and findings
Not stated
Not stated
Commercial use and plan restrictions
Not stated
Not stated
Best ZeroThreat alternatives for different needs
"Better suited" is based on documented features and pricing, not on a head-to-head test.
Not verified: Platforms; Privacy (404); US availability; Official pages could not be read as text (client-rendered or empty fetch); facts come from the verified seed research.
How we documented and maintain this page
Every fact about ZeroThreat above comes from the 2 official pages listed here, last compared on Oct 4, 2026; we have not run ZeroThreat ourselves, so it has no editorial score. How we check and re-check pages.
Article updated Oct 2, 2026; prices checked Oct 4, 2026. Outbound links to vendors are plain links; we do not earn commissions. How we review · Report an error