Mayhem

Overview

Mayhem brings automated security testing for code, APIs and software components into one dashboard. It is best suited to teams that want fuzz testing and API checks in a development workflow, alongside analysis of exposed dependencies. The breadth is useful, but teams focused only on API testing should weigh the 50-scan monthly free cap against paid access at $236 a month.

Key features

Mayhem combines AI-powered, network-aware fuzzing with symbolic execution and intelligent triage. Hybrid input generation and execution, coverage guidance and crash triage support work across Linux and Windows PE binaries, TCP/UDP applications, REST APIs and gRPC APIs. Supported languages include C/C++, Python, Go, Rust and Java. That range makes Mayhem relevant beyond teams testing web APIs, though it may be more platform than a team needs if its only target is a narrow API surface.

For code security, Mayhem generates tests autonomously and supplies a reproduction and backtrace for each defect, giving developers a concrete starting point for investigation. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis distinguishes components on the attack surface from those that are not, helping teams focus on exposed software components.

Integrations include GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Vendor-neutral SARIF reports and real-time notifications can carry findings into reporting and team workflows. Enterprise SSO supports SAML, OpenID or OAuth; enterprise customers can also integrate LDAP and Active Directory. Deployment options include managed SaaS, private-cloud installation and closed-network installation, giving organizations choices for different environments.

Pricing

Mayhem for API Free Plan: free, with up to 50 scans per month. It suits limited evaluation or low-volume API testing, but the monthly cap makes it a poor fit for teams that need sustained, higher-volume coverage.

Mayhem for API paid plans: $236 a month. Paid offerings include additional scans, enterprise features and personalized support; paid plans have a free 30-day trial with limits removed. This is the more practical option for teams whose API testing exceeds the free allowance or who need the paid features. The paid offer is specifically described for Mayhem for API, so it should not be treated as a price for every Mayhem capability.

Other Mayhem pricing is custom pricing. The feature set includes enterprise support, and deployment choices include private-cloud and closed-network installation, but those do not have a stated price here.

Platforms

Mayhem's listed platforms are API, Linux, macOS, self-hosted, web and Windows. Its CLIs run on macOS, Linux and Windows. This covers teams using desktop operating systems as well as web and self-hosted environments, though the listed platforms do not by themselves specify which deployment option suits each feature.

Who it's for

Mayhem is a strong fit for development and security teams that need to test binaries, networked applications and APIs, and want findings with reproduction details, triage and reporting. Teams with deployment constraints may value its managed SaaS, private-cloud and closed-network options. It is less compelling for teams that need only occasional API scans and can stay within a 50-scan monthly allowance, or for buyers who need a single fixed price covering the full platform.

Pros and cons

Pros: Hybrid fuzzing and symbolic execution span binaries, network applications and APIs, with coverage guidance and crash triage to support investigation.

Pros: Autonomous code tests include a reproduction and backtrace for each defect, rather than leaving developers with an alert alone.

Pros: API checks, dynamic SBOM reachability, workflow integrations and vendor-neutral SARIF reporting bring several security tasks together.

Cons: The free API plan stops at 50 scans per month, which may constrain regular testing.

Cons: The $236.00 USD monthly paid plan is for Mayhem for API, while pricing for the broader offering is custom, making cost comparison less straightforward.

Alternatives

For a free, open-source fuzzing option, ClusterFuzz is worth considering; its production deployment depends on Google Cloud services. AFL++ is another free option, distributed under AGPL-3.0-or-later terms. Rust teams looking for a free fuzzer can consider cargo-fuzz, which is offered under MIT or Apache License 2.0. Jazzer is a free alternative for coverage-guided, in-process JVM fuzzing, with platform and architecture requirements. Teams that want to build fuzzer scripts in Python can look at boofuzz, a free GPL-2.0-licensed library. Fuzzilli is free source code for JavaScript-engine fuzzing, but requires building the fuzzer and a supported, instrumented engine. For free API testing generated from OpenAPI and GraphQL schemas, Schemathesis is a more focused option. Accessibility Test Framework for Android is another listed alternative.

For a broader view of the category, see Fuzz Testing Software.

Verdict

Choose Mayhem if your team needs one security-testing platform for code, APIs and dynamic SBOM analysis, and values actionable defect evidence and flexible deployment. Look elsewhere if your needs are limited to low-volume API checks or a narrowly focused free fuzzing tool: the free allowance is capped, and the broader platform has custom pricing.