Buyer’s guide · Technology
Best Vulnerability Scanning Software in 2026: Pricing & Comparison
We compared four scanning vendors on published price, what the free tier actually scans, and where quotes start.
- A few app scan hours: Probely — $0 with 5 scan hours a month.
- Weekly external scans: Intruder — free plan; paid targets are quote-plus-usage.
- Annual AppSec fee: Detectify — Starter from €0, Standard from €2,500/year before assets.
- In-repo credits: Snyk — 1 credit = $1, from $25/month on the plans page title.
Vulnerability scanning software checks apps, APIs, and exposed infrastructure for known weaknesses. This guide is DAST and attack-surface tools a buyer can price from an official page, not a full SOC platform.
Every vendor is scored on the same fields: published pricing, free plan or trial, core focus, and main limitation. Order is not a quality ranking. Sort rule: public $0 or the lowest published starting price first, quote-led plans last.
Compared at a glance
| Provider | Published pricing | Billing unit | Best for | Visit |
|---|---|---|---|---|
| 1. Probely | Free $0; Enterprise quote | Per scan hour | Monthly app scans | Visit → |
| 2. Intruder | Free plan; paid base + per target | Per target | External checks | Visit → |
| 3. Detectify | Starter from €0; Standard from €2,500/yr | Platform fee + assets | AppSec teams | Visit → |
| 4. Snyk | From $25/mo; 1 credit = $1 | Per contributor-day | Developer scanning | Visit → |
Prices checked 9 October 2026 on official pricing pages. Intruder Cloud and Pro dollar amounts did not render in the page text, so they are not repeated here. Detectify prices are euros and exclude extra per-asset fees.
Why scanner prices are hard to compare
Probely meters scan hours. Intruder meters targets for 30 days. Detectify splits a platform fee from per-domain fees. Snyk meters contributor-days and images. A “from $0” plan can still be the wrong tool if authenticated DAST or internal networks sit on a quote.
The 4 companies in detail
Probely
Fit for a monthly app scan
Best for: teams that want DAST hours without a platform fee.
| Attribute | Probely |
|---|---|
| Published pricing | Free plan $0 per month with 5 free scan hours. Enterprise is contact-only, with 5 targets included. |
| Free plan or trial | Free forever. No paid self-serve price was listed. |
| Core focus | Web and API scanning, including SPA support. Enterprise adds asset discovery, internal agent, SSO, and compliance reports. |
| Main limitation | Unlimited scans and SSO are on the quote-only Enterprise plan. |
- Free includes up to 3 users and standard reports.
- API scanning accepts OpenAPI or Postman collections.
- Internal targets need the Enterprise agent.
Intruder
Fit for a free external check
Best for: small teams starting with weekly external scans before a per-target quote.
| Attribute | Intruder |
|---|---|
| Published pricing | Free plan published (weekly external scans, 3 users, 1 cloud account). Cloud and Pro are a base fee plus per-target; dollar figures did not render on the page text checked. Enterprise is custom. Pentests from $3,500. |
| Free plan or trial | Free plan. Paid plans are monthly or annual, with 20% noted on annual. |
| Core focus | External infrastructure, cloud, containers, and authenticated web app DAST on paid tiers. |
| Main limitation | Internal scanning is Pro and Enterprise only, and Pro is annual-only. |
- Emerging threat scans start on Cloud.
- Integrations include Slack, Jira, GitHub, and cloud accounts.
- A license stays used for 30 days per target, so target churn still costs a seat.
Detectify
Fit for AppSec platform fees
Best for: security engineers who can budget an annual platform fee plus per-asset costs.
| Attribute | Detectify |
|---|---|
| Published pricing | Starter from €0 annual platform fee, up to 5 users. Standard from €2,500/year. Professional from €5,000/year. Enterprise from €15,000/year. Surface, app, and API scanning cost extra per asset. PCI ASV is €500/year. |
| Free plan or trial | Starter can start for free. Paid tiers use a demo path. |
| Core focus | External attack-surface and application scanning, including REST and GraphQL API scanning. |
| Main limitation | The platform fee is not the full bill. Domains and targets are additional. |
- Non-profits are listed at 30% off.
- SSO starts on Standard.
- Internal scanning is Professional and above, and extra environments cost more.
Snyk
Fit for developer-in-repo scanning
Best for: teams that want credit-based AppSec across code, open source, and containers.
| Attribute | Snyk |
|---|---|
| Published pricing | Plans page title says try free or from $25/month. Rate card: 1 credit = $1. Code and Open Source are 1.0 credit per active contributor per day. Enterprise is custom. Open-source maintainers can apply for no-cost access. |
| Free plan or trial | Free path for open-source maintainers. Commercial free tier limits were not itemized on the plans page. |
| Core focus | Code, open source, IaC, secrets, containers, and API/web DAST drawn from one credit pool. |
| Main limitation | Overages are invoiced in arrears if credits run out before the term ends. |
- Credits can be mixed across capabilities.
- API and web DAST is 3.0 credits per provisioned target per day.
- AI pentesting is 4,000 credits per assessment, so one test can dwarf daily scanning.
Kurums Match
I have one app and a few hours a monthFree DAST hours
I want a weekly look at exposed hostsFree external tier
Intruder Free includes weekly external scans and one cloud account. Paid per-target prices did not render on the check date.
We need SSO and an AppSec budgetAnnual platform fee
Detectify Standard starts at €2,500 per year and includes SSO. Asset scanning is extra.
Developers should scan pull requestsCredit pool
Snyk prices Code and Open Source at 1 credit ($1) per active contributor per day. The plans page says from $25/month.
Buying tip
Ask for the bill at your real target count, not the platform minimum. Detectify and Intruder both add cost per asset after the entry fee.
FAQ
Is a free scanner enough for SOC 2 evidence?
Does the free tier scan APIs?
Probely Free includes API scanning. Intruder lists web app and API testing on Cloud, not on the free feature list checked. Detectify includes API scanning capability and charges per target.
What is a Snyk credit?
The plans page sets 1 credit at $1. Code is 1.0 credit per active contributor per day. Unused-credit rules and expiry were not fully listed in the FAQ extract.
Can I scan internal networks?
Probely’s internal agent is on the Enterprise plan. Intruder and Detectify pricing pages did not print a dollar price for internal scanning on the check date, so confirm that tier before you budget it.
Related comparisons
Last updated 9 October 2026 · Pricing checked 9 October 2026.
Disclosure: Kurums is reader-supported. Some links may be affiliate or sponsored links, marked as such; they never affect rankings or which products appear.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.
