Burp Suite DAST 8.6 Visit ZeroThreat
zerothreat.ai
What it is
ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs, accessible through web and API. It continuously discovers, exploits, and validates vulnerabilities, with findings backed by reproducible request-and-response evidence and exact payloads. Web testing supports authenticated workflows, including SSO, MFA, and role-based access, as well as rendering for React, Vue, and Angular single-page apps. API testing covers REST, GraphQL, SOAP, and gRPC, including internal APIs, shadow endpoints, BOLA, and BFLA. ZeroThreat says it detects more than 130,000 vulnerabilities, spanning OWASP, CWE/SANS, Nuclei, and monthly updated CVE intelligence. Integrations include CI/CD, project-management, and messaging tools, connected through native connectors, APIs, or webhooks. On-premises deployment is listed as air-gap ready. The free plan provides five sign-up scan credits valid for 15 days, then one scan credit per month for one target. Professional costs $100 a month; Pay Per Scan costs $125, paid once.
Spec sheet
- Product
- ZeroThreat is an AI-powered autonomous penetration-testing platform that continuously discovers, exploits, and validates vulnerabilities across web applications and APIs.Read 30 Sep 2026 · zerothreat.ai
- Deployment
- The homepage lists on-premises deployment as air-gap ready for full data sovereignty.Read 30 Sep 2026 · zerothreat.ai
- Integrations
- Integrations include GitHub Actions, GitLab, Jenkins, Azure Pipelines, CircleCI, TeamCity, AWS CI/CD, Bamboo, Travis CI, Jira, Asana, Slack, and Microsoft Teams.Read 30 Sep 2026 · zerothreat.ai
- Headquarters
- United StatesRead 23 Sep 2026 · zerothreat.ai
- API testing
- API pentesting covers REST, GraphQL, SOAP, and gRPC APIs, including internal APIs, shadow endpoints, BOLA, and BFLA.Read 30 Sep 2026 · zerothreat.ai
- Company identity
- The legal entity is ZeroThreat, Inc., a U.S.-registered corporation.Read 30 Sep 2026 · zerothreat.ai
- Coverage
- ZeroThreat states that it detects more than 130,000 vulnerabilities, including OWASP, CWE/SANS, Nuclei, and monthly updated CVE intelligence.Read 30 Sep 2026 · zerothreat.ai
- Documentation
- ZeroThreat provides a Help Center with getting-started, quick-scan, authenticated-scan, and login-sequence documentation.Read 30 Sep 2026 · help.zerothreat.ai
- Exploit validation
- The platform provides reproducible exploit proof with request/response evidence and exact payloads for findings.Read 30 Sep 2026 · zerothreat.ai
- Integration methods
- Integrations connect through native connectors, APIs, or webhooks, with no-code guided setup and API or CLI customization.Read 30 Sep 2026 · zerothreat.ai
- Scan timing
- The pricing FAQ says scans typically complete in 30 minutes to 2 hours depending on the application, with scans starting within minutes.Read 30 Sep 2026 · zerothreat.ai
- Security controls
- The security architecture describes IAM, MFA, network segmentation, TLS 1.3 in transit, Azure Key Vault encryption at rest, and continuous monitoring.Read 30 Sep 2026 · zerothreat.ai
- Security standards
- ZeroThreat states that it complies with GDPR, HIPAA, and PCI DSS and aligns its security measures with ISO 27001 guidelines.Read 30 Sep 2026 · zerothreat.ai
- Use cases
- ZeroThreat presents use cases for enterprise security teams, DevOps and security teams, SaaS companies, developers, MSSPs, and startups.Read 30 Sep 2026 · zerothreat.ai
- Web testing
- Web-app pentesting supports authenticated workflows, SSO, MFA, role-based access, and Playwright rendering for React, Vue, and Angular SPAs.Read 30 Sep 2026 · zerothreat.ai
Plans and prices
Free Free 5 free scan credits on sign-up, valid for 15 days 1 scan credit per month · 1 target per account · limited vulnerability-insights preview · web applications and APIs Read 30 Sep 2026 · zerothreat.ai
Professional $100 a month Monthly; additional targets @ $75 each; annual option saves 20% Target-based unlimited scans · scheduled scans · 130K+ vulnerability coverage · unlimited retesting · 30-day target-URL cooling Read 30 Sep 2026 · zerothreat.ai
Pay Per Scan $125, paid once 5 credits; credits valid for 1 year; volume discounts up to 20% Unlimited targets · 7-day unlimited retest window · point-in-time compliance reporting Read 30 Sep 2026 · zerothreat.ai
Strong points and limits
Strong points
- Evidence includes requests, responses, and exact payloads
- Tests authenticated web workflows and major API types
- Supports scheduled scans and unlimited retesting on Professional
- Air-gap-ready on-premises deployment is listed
Limits
- Free sign-up credits are valid for 15 days
- Free plan limits accounts to one target
- Professional costs $100 a month
- Pay Per Scan costs $125, paid once
Who it suits
ZeroThreat suits security, DevOps, and development teams testing web applications and APIs, including teams needing authenticated scans or CI/CD integrations. It also presents use cases for SaaS companies, MSSPs, and startups.
Verdict
ZeroThreat specifies web and API coverage, authenticated testing, integrations, and reproducible evidence for findings. The free tier is limited by credits and targets; paid options are $100 a month or $125, paid once.
Where Specifiction places it
- Web Application Security Scanners#14 of 297.6
- API Security Testing Software#17 of 277.6
