Skip to content
SPECIFICTION
Get listed

runZero

runzero.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit runzero.com
Spec score 8.5 #3 of 20 in Exposure Management Software

What it is

runZero is an attack surface and exposure management platform for inventorying IT, OT, IoT, cloud, mobile, and remote assets. It combines active scanning, passive traffic sampling, and API integrations to keep the inventory updated. Tracked information can include assets, services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups. Reports include layer-2 topology maps and asset risk; alerts can appear in-product or arrive by email or webhook, including Slack. The service can run as hosted SaaS or on-premise using Consoles, distributed Explorers, and a command-line tool. runZero says it operates without agents, authentication, or appliances. Prebuilt integrations span cloud providers, EDRs, MDMs, vulnerability scanners, ITSM systems, and detection platforms, with an API and scripts for custom integrations. Community Edition is free for up to 100 assets, one organization, 10 recurring tasks, and 30 days of data retention. The Platform costs what you agree with the maker. Self-hosting the console requires a Platform license with runZero Care explicitly enabled.

Spec sheet

What it does
runZero is an exposure-management platform that combines active scanning, passive traffic discovery and integrations to maintain a continuously updated inventory of IT, OT, IoT, cloud, mobile and remote assets.Read 15 Oct 2026 · help.runzero.com
Purpose
runZero is an attack surface and exposure management platform covering IT, OT, IoT, cloud, mobile, and remote assets.Read 30 Sep 2026 · help.runzero.com
Integrations
Inbound integrations include AWS, Google Cloud, Azure, Prisma, VMware, Wiz, CrowdStrike, Microsoft 365 Defender, Intune, Miradore, SentinelOne, Tanium, MECM and Google Workspace.Read 15 Oct 2026 · help.runzero.com
Compliance
runZero announced completion of an independent SOC 2 Type II audit and documents mappings to frameworks including CIS Controls, CMMC, ISO 27001, NERC-CIP, NIST CSF and PCI DSS.Read 15 Oct 2026 · runzero.com
Support
runZero offers documentation, API resources, release notes, a Trust Center, and human support through the console or contact form.Read 30 Sep 2026 · runzero.com
Active scanning
Its proprietary active scanner fingerprints operating systems, services, hardware and software and is designed for IT, OT and IoT environments.Read 15 Oct 2026 · runzero.com
Agent requirements
runZero states that it operates without agents, authentication, or appliances.Read 30 Sep 2026 · runzero.com
API security
API access supports API keys or OAuth-style API clients, configurable IP allowlists and a documented limit of 2,000 requests per five minutes per source IP.Read 15 Oct 2026 · help.runzero.com
Company facts
LinkedIn lists Austin, Texas headquarters, 51–200 employees, private ownership and a 2018 founding year.Read 15 Oct 2026 · linkedin.com
Company identity
Crunchbase lists the legal name as runZero, Inc., formerly Rumble Network Discovery, and says it was acquired by Dragos.Read 15 Oct 2026 · crunchbase.com
Custom extensibility
Customers can build integrations with the Custom Integration API, custom scripts and a runZero Python SDK.Read 15 Oct 2026 · help.runzero.com
Data protection
runZero states that customer data is logically separated and encrypted at rest and in transit.Read 30 Sep 2026 · runzero.freshdesk.com
Deployment model
runZero can run as a hosted SaaS service or on-premise with Consoles, distributed Explorers, and a command-line tool.Read 30 Sep 2026 · help.runzero.com
Discovery
The platform combines high-speed active scanning, passive traffic sampling, and API integrations into a continuously updated inventory.Read 30 Sep 2026 · help.runzero.com
Documentation and support
The help center provides user-guide and API PDFs, an HTML API package, SBOM, training, release notes and human support through the console or contact form.Read 15 Oct 2026 · runzero.com
Explorer deployment
Explorers install as services on Windows, Linux, macOS and BSD, require administrator or root privileges, and can also run in containers with raw-network access.Read 15 Oct 2026 · help.runzero.com
Exposure management
The platform identifies vulnerabilities and other exposures through query logic, active scans and vulnerability or endpoint-management integrations, then recalculates findings and asset risk during task processing.Read 15 Oct 2026 · help.runzero.com
Funding history
runZero’s history page says Rumble raised $5 million in 2021 and $15 million in a 2022 Series A led by Decibel Partners.Read 15 Oct 2026 · runzero.com
Inventory
The inventory tracks assets, services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups.Read 30 Sep 2026 · help.runzero.com
Licence
The master subscription agreement says the Services are licensed rather than sold, runZero retains intellectual-property ownership, and third-party open-source components are separately attributed.Read 15 Oct 2026 · runzero.com
Limit: reporting depth
A GetApp reviewer wanted more built-in presentation of the raw data and reporting or analysis capabilities.Read 15 Oct 2026 · getapp.co.uk
Limit: scan safety and classification
Review feedback notes that aggressive packet rates can risk disrupting devices and that some device categories or operating-system fingerprints may be inaccurate.Read 15 Oct 2026 · getapp.co.uk
Limit: usability
A G2 reviewer said some menus and functions were not intuitive, while Gartner feedback said querying the database took time to learn.Read 15 Oct 2026 · g2.com
Network and attack-surface views
Features include network topology, external and internal attack-surface visibility, RFC1918 coverage, outlier identification, segmentation analysis and vulnerability prioritization.Read 15 Oct 2026 · runzero.com
Notable news: Dragos acquisition
The company’s history page records that runZero became a Dragos company in 2026.Read 15 Oct 2026 · runzero.com
Notable news: version 5.1
Release notes dated August 26, 2026 describe AI workflows, OAuth support for the MCP service, Mermaid diagrams, Censys v3 support and faster MAC merging.Read 15 Oct 2026 · help.runzero.com
Outbound integrations
Outbound connectors include Jira and Atlassian Insight, ServiceNow CMDB, Panther, Splunk, Sumo Logic, Tines, Thinkst Canary and SecurityGate.io.Read 15 Oct 2026 · help.runzero.com
Passive discovery
Explorers can continuously sample broadcast, SPAN-port and encapsulated traffic for always-on discovery, including fragile OT environments.Read 15 Oct 2026 · help.runzero.com
Praise: deployment and support
Reviewers describe deployment as quick, scanners as flexible across platforms, and runZero support as responsive.Read 15 Oct 2026 · softwareadvice.com
Praise: discovery quality
Independent reviewers repeatedly praise fast, thorough unauthenticated discovery, broad protocol coverage, accurate asset visibility and useful network insight.Read 15 Oct 2026 · getapp.co.uk
Public API
runZero exposes Export, Organization and Account APIs; Export is read-only, Organization is read-write for licensed organizations, and Account controls account-wide settings for Platform licenses.Read 15 Oct 2026 · help.runzero.com
Rating on Capterra
4.9 out of 5 from 37 reviewsRead 15 Oct 2026 · capterra.com
Rating on G2
4.0 out of 5 from 1 reviewRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.6 out of 5 from 38 reviewsRead 15 Oct 2026 · gartner.com
Rating on GetApp
4.9 out of 5 from 37 reviewsRead 15 Oct 2026 · getapp.co.uk
Rating on Software Advice
4.9 out of 5 from 37 reviewsRead 15 Oct 2026 · softwareadvice.com
Reporting and alerts
Reports include layer-2 topology maps and asset risk, while alerts can be delivered in-product, by email, or by webhook including Slack.Read 30 Sep 2026 · help.runzero.com
SDK status
The public GitHub repository provides an OpenAPI v3 specification, Swagger documentation, offline PDF and bundled Swagger UI; its Python SDK is beta and does not cover every API.Read 15 Oct 2026 · github.com
Security compliance
runZero completed a SOC 2 Type II audit covering the security Trust Service Criteria.Read 30 Sep 2026 · runzero.com
Security controls
runZero states that customer data is logically separated, encrypted in transit and at rest, audited through console events, and protected by hardware MFA for privileged staff.Read 15 Oct 2026 · runzero.freshdesk.com
Self-hosting
The entire platform can run on-premises or in a customer cloud, including fully offline operation with no inventory data sent back to runZero; self-hosting requires a Platform license or trial.Read 15 Oct 2026 · help.runzero.com
Self-hosting limit
Self-hosting the console requires a Platform license with the additional runZero Care support package explicitly enabled.Read 30 Sep 2026 · runzero.com
Supported Explorer systems
Explorer binaries are available for Windows, Linux, and macOS, and installation requires administrative or root privileges.Read 30 Sep 2026 · help.runzero.com
System requirements
Explorer guidance calls for a 2.0 GHz processor, 16 GiB RAM (8 GiB for small environments) and 1 GB free storage; supported examples include Windows Server 2016+, Windows 10 build 1604+, Linux kernel 3.2+ and macOS 11+.Read 15 Oct 2026 · help.runzero.com
Target users
The Community Edition is designed for small businesses, individuals, and security researchers with 100 or fewer assets, while the Platform is built for enterprises.Read 30 Sep 2026 · runzero.com
Unified inventory
The inventory correlates and deduplicates data from scans, passive sampling and integrations, tracking assets through attributes such as MAC addresses, IPs, hostnames and fingerprints.Read 15 Oct 2026 · help.runzero.com

Plans and prices

Community Edition Free 100 assets · 1 organization · 10 recurring tasks · 30 days data retention Read 30 Sep 2026 · runzero.com
Community Edition Free Flat Rate, Per Month 100 recent assets · 1 organization · 10 recurring tasks · 30 days data retention · self-hosted Explorers Read 15 Oct 2026 · capterra.com
runZero Platform Priced on request Starts at $5,000 Contract asset limit · unlimited organizations · self-hosted console requires Platform plus runZero Care Read 15 Oct 2026 · runzero.com

Every runZero plan and price →

Strong points and limits

Strong points

  • Discovers IT, OT, IoT, cloud, mobile, and remote assets.
  • Inventory combines active scans, passive sampling, and APIs.
  • Alerts can arrive by email or webhook.
  • Community Edition covers up to 100 assets.

Limits

  • Community Edition retains data for 30 days.
  • Community Edition allows one organization.
  • Self-hosted console requires Platform and runZero Care.
  • Platform costs what you agree with the maker.

Who it suits

Community Edition is designed for small businesses, individuals, and security researchers with 100 or fewer assets. The Platform is built for enterprises; teams planning to self-host the console need the license and support package specified for that deployment.

runZero in depth

Read the full write-up

runZero is an attack surface and exposure management platform for organizations that need to find and track assets across varied environments. It will suit security teams seeking one inventory fed by scanning, traffic sampling, and integrations; small environments can start with a capped free edition, while the enterprise tier adds scale and is required for console self-hosting.

Overview

runZero combines active scanning, passive traffic sampling, and API integrations to maintain an inventory spanning IT, OT, IoT, cloud, mobile, and remote assets. The inventory goes beyond devices to include services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups. That breadth is valuable when exposure work depends on relating network assets to software and risk context, rather than keeping separate lists.

Its agentless model avoids deploying agents, supplying authentication, or installing appliances. That reduces collection prerequisites, though Explorer binaries still need administrative or root privileges to install. Teams can use hosted SaaS or run on-premise Consoles with distributed Explorers and a command-line tool; the latter is not a way around the enterprise tier, since console self-hosting requires Platform and runZero Care.

Key features

Discovery and inventory

Active scans, passive sampling, and integrations cover hardware, software, cloud, and network discovery. Using several collection paths is a practical advantage in environments where one technique will miss assets. Prebuilt connections span cloud providers, EDR, MDM, vulnerability scanning, ITSM, and detection platforms, with a Custom Integration API and scripts for additional connections. The payoff depends on which systems an organization can connect and maintain.

Reporting, alerts, and safeguards

Reports include layer-2 topology maps and asset-risk views; alerts can arrive in the product, by email, or by webhook, including Slack. Those options give teams ways to surface findings in existing workflows. runZero has completed a SOC 2 Type II audit covering the security Trust Service Criteria, and says customer data is logically separated and encrypted at rest and in transit. Documentation, API resources, release notes, a Trust Center, and human support through the console or contact form round out its operational support.

Pricing

The Community Edition costs free and is aimed at individuals, small businesses, and security researchers with 100 or fewer assets. It allows one organization, 10 recurring tasks, and 30 days of data retention. That is a useful entry point for a bounded environment, but the asset ceiling and short retention make it a poor fit for larger inventories or longer-term analysis.

runZero Platform costs priced on request, with the asset limit set by contract. It includes unlimited organizations, projects, and recurring tasks, plus three years of data retention. This is the enterprise option for larger deployments; organizations considering a self-hosted console must also enable the additional runZero Care support package. The pricing model is freemium, and a 21-day trial is offered.

Platforms

runZero supports API, Linux, macOS, self-hosted, web, and Windows environments. Explorer binaries are available for Windows, Linux, and macOS, and require administrative or root privileges for installation.

Who it's for

The Community Edition is the sensible starting point for small organizations and researchers whose asset count fits within 100 and whose retention needs fit within 30 days. Platform is better suited to enterprises that need contract-defined capacity, multiple organizations or projects, more recurring tasks, and longer retention. Teams that need an on-premise console should budget for both Platform and runZero Care. Organizations seeking a single small-network inventory may find the free edition sufficient; those needing more than its caps should not mistake it for a scalable free tier.

Pros and cons

Pro: Multiple discovery methods feed one inventory, helping teams account for assets that a single scanning method could miss.

Pro: Inventory includes software, vulnerabilities, certificates, wireless devices, users, and groups as well as assets and services, broadening the context available for exposure work.

Pro: The free edition gives small environments a no-cost route to 100 assets, while the Platform tier extends retention to three years and removes organization, project, and recurring-task caps.

Con: Community Edition's 100-asset limit, one-organization allowance, 10 recurring tasks, and 30-day retention constrain its usefulness as an organization grows.

Con: Self-hosting the console requires the enterprise Platform license and runZero Care, so it is not a low-cost deployment alternative.

Con: Explorer setup requires administrative or root privileges despite the agentless approach.

Alternatives

For a free, open-source framework on Linux, macOS, self-hosted, or Windows, consider OWASP Amass; it is a more focused choice than runZero's broader inventory platform. If a 30-day no-cost evaluation is preferable to runZero's ongoing capped free tier, Qualys External Attack Surface Management offers CSAM with EASM at no cost for 30 days.

FullHunt may suit users looking for a freemium option with 10 monthly credits on its free plan, limited to evaluation and internal use, or a $149.00 Builder plan. Detectify Surface Monitoring has a free Starter tier for up to five users and one team, with monitoring charged extra per domain; its Standard plan is €2,500 a year. For a consumer security suite rather than an asset-discovery platform, Bitdefender Total Security costs $59.99 a year for the first year, plus applicable sales tax, for five devices and one account.

CrowdStrike Falcon Surface, Ivanti Neurons for Zero Trust Access, and Rapid7 Surface Command are also alternatives to compare.

Explore more options in Attack Surface Management Software, Exposure Management Software, Network Discovery Software, and IT Asset Discovery Software.

Verdict

Choose runZero if your security team needs a broad, continuously updated asset view built from several discovery methods, with useful inventory context and risk reporting. Its strongest case is the combination of agentless discovery and a deep inventory; its main drawbacks are the Community Edition's tight caps and the Platform-plus-Care requirement for console self-hosting. If your environment exceeds the free limits or needs on-premise control, plan for the enterprise tier; if you only need a small, bounded inventory, Community Edition is the more proportionate choice.

Verdict

runZero combines multiple discovery approaches with inventory, reporting, and alerts. Community Edition has stated asset and retention limits; self-hosting the console requires the Platform license and runZero Care.

Where Specifiction places it

Alternatives to runZeroAll alternatives →