All prices in EUR, excluding VAT. No subscriptions — pay per scan.
| Feature | Basic €69 |
Standard €169 |
Premium €349 |
Enterprise €899 |
|---|---|---|---|---|
| Scanning & Discovery | ||||
| Effective security checks | 4,500+ | 20,000+ | 40,000+ | 60,000+ |
| Estimated scan time | 20-40 min | 1-3 hrs | 2-6 hrs | 60-120 min |
| SSL/TLS analysis (TestSSL) | 80+ checks | 80+ checks | 80+ checks | 80+ checks |
| HTTP security headers | 50+ checks | 50+ checks | 50+ checks | 50+ checks |
| Port scanning | Top 100 | All 65,535 | All + UDP | All + UDP + services |
| DNS & email security | ||||
| Sensitive file discovery | ||||
| CMS detection | ||||
| Subdomain enumeration | — | |||
| Directory brute-forcing (FFuf) | — | 4,000+ paths | 4,000+ paths | Recursive + deep |
| API endpoint discovery | — | |||
| OSINT reconnaissance | — | — | — | |
| Vulnerability Detection | ||||
| Nuclei vulnerability templates | 3,000+ | 7,500+ | 12,900+ | 15,600+ (official + AI + community) |
| SQL injection (SQLMap) | — | Level 3 | Level 5 + WAF bypass | Level 5 + all tampers |
| XSS detection (DalFox) | — | Basic | Blind + DOM | Full + WAF evasion |
| SSTI detection (SStimap) | — | — | ||
| SSRF detection | — | — | ||
| OS command injection (Commix) | — | — | Level 3 + time-based | |
| HTTP request smuggling | — | — | ||
| XXE injection | — | — | ||
| Deserialization attacks | — | — | ||
| Smart parameter fuzzing | — | — | — | |
| Authentication & Session | ||||
| Cookie security analysis | ||||
| CORS analysis | Deep exploitation | Deep exploitation | ||
| Auth & session testing | — | |||
| JWT analysis (JWT_Tool) | — | — | Full + key brute force | |
| OAuth/OIDC testing | — | — | ||
| IDOR detection | — | — | ||
| Supply Chain & Infrastructure | ||||
| JavaScript CVE analysis | — | |||
| Retire.js scanning | — | — | ||
| Gitleaks secret detection | — | — | ||
| Cloud misconfig (AWS/GCP/Azure) | — | |||
| Kubernetes/Docker exposure | — | — | — | |
| CI/CD pipeline exposure | — | — | — | |
| AI Analysis | ||||
| AI-powered finding analysis | Sonnet | Tiered | Tiered | Tiered |
| Executive summary | Opus | Opus | Opus | Opus |
| Quality review | Opus | Opus | Opus | Opus |
| Adaptive AI test triggers | Up to 5 | Up to 10 | Up to 25 | Up to 40 |
| Opus strategic scan planning | — | — | ||
| Attack path mapping (AI) | — | — | — | |
| Compliance | ||||
| OWASP Top 10:2025 | ||||
| OWASP WSTG v4.2 | — | |||
| OWASP ASVS 5.0 | — | — | L1 + L2 | L1 + L2 + L3 |
| NIS2 Directive | ||||
| GDPR Art 32/35 | ||||
| PCI DSS v4.0.1 | — | |||
| DORA | — | — | ||
| ISO 27001 | — | — | — | |
| Cyber Resilience Act (CRA) | — | — | — | |
| NIST CSF 2.0 | — | — | — | |
| Reports | ||||
| PDF report | ||||
| HTML interactive report | ||||
| JSON machine-readable | ||||
| Markdown report | ||||
| Passed checks appendix | ||||
| AI remediation with code | ||||
| Compliance gap analysis | ||||
Extend any tier with specialized testing modules.
AI-written board-level summary in plain language. Risk posture, top priorities, compliance implications.
Your logo, colors, and company name on all reports. White-label ready.
Full white-label: no ScanMySite branding anywhere. Resell to your clients.