ImmuniWeb

ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure. Its Discovery product monitors attack surfaces, third-party risks, dark-web activity, and cyber threats. Neuron scans web applications and APIs, including authenticated scans, patch verification, and OWASP vulnerability checks. On-Demand provides web application and API penetration tests with compliance-oriented reports and remediation assistance; MobileSuite tests mobile apps and their backend APIs or web services. Discovery packages include dashboard and API access, PDF and XLS exports, JSON through a REST API, and 24/7 expert assistance. The Community Edition offers free online tests for SSL, email security, website security and privacy, mobile app security, and dark-web and threat exposure. The company says Discovery helps address monitoring requirements under frameworks including GDPR, DORA, NIS 2, HIPAA, ISO 27001, SOC 2, and PCI DSS. ImmuniWeb was founded in 2014 and is headquartered in Geneva, Switzerland. A free plan is available, and listed paid scan subscriptions start at €395.00 per month.

ImmuniWeb brings scanning, monitoring, and penetration testing into one platform, alongside a no-cost Community Edition. Its listed paid subscriptions and tests are priced for specific targets, apps, or engagements.

ImmuniWeb suits organizations assessing application, API, infrastructure, or third-party security. Its Community Edition is described as serving SMEs, colleges, universities, and small municipal governments.

Overview

ImmuniWeb is a security platform for organizations evaluating applications, APIs and infrastructure, with distinct products for scanning, penetration testing and continuous exposure monitoring. It is best suited to teams that need several of those capabilities; smaller organizations can begin with its no-cost Community Edition. The breadth is a strength, but paid Discovery subscriptions and penetration tests carry substantial costs.

Key features

Scanning and testing

Neuron scans web applications and APIs, including authenticated scans, JavaScript crawling, scheduled checks, patch verification and OWASP vulnerability checks. Unlimited scans of the same app or target make it useful for repeated checks as software changes, rather than paying by each scan. MobileSuite tests mobile apps and can include their backend APIs or web services. On-Demand provides web and API penetration testing with compliance-oriented reporting and remediation assistance, a better fit for a scoped assessment than ongoing automated scanning.

Discovery and monitoring

Discovery brings together attack-surface management, continuous security monitoring, third-party risk management, dark-web monitoring and cyber-threat intelligence. Its packages include dashboard and API access, PDF and XLS exports, JSON through a REST API, and 24/7 expert assistance. The combination suits organizations that need recurring exposure oversight, though the annual subscription and asset limits make it a bigger commitment than a one-off scan.

Integrations and compliance

Integrations include GitHub Actions, GitLab CI/CD, Azure Pipelines, Jenkins, Asana, Jira, Slack, Splunk, Okta and Microsoft Teams. Discovery supports monitoring requirements associated with GDPR, DORA, NIS 2, HIPAA, ISO 27001, SOC 2 and PCI DSS. ImmuniWeb also cites ISO/IEC 27001:2022 among the standards addressed on its product pages. These capabilities are relevant to teams coordinating security work across development and compliance workflows, but do not replace the underlying work of meeting a regulation or framework.

Pricing

ImmuniWeb uses a freemium model. Community Edition offers no-cost online tests for SSL, email security, website security and privacy, mobile app security, and dark-web and threat exposure. It is a practical starting point for SMEs, colleges, universities and small municipal governments, but the paid subscriptions provide the recurring scanning, monitoring or scoped testing described below.

The Neuron annual subscriptions have a notably lower stated price than the monthly options, but suit only buyers prepared to plan on an annual basis. Discovery's packages are one-year commitments, cap included assets and/or incidents at 10,000, and charge flexibly for additions; the higher tiers add 25 or 100 TPRM vendors. On-Demand is priced per test, not as a recurring subscription, and each engagement may span multiple domains, subdomains or APIs.

Platforms

ImmuniWeb supports Android, iOS, web and API environments. Its deployment model is hybrid, which may suit organizations combining environments rather than seeking a single-platform scanner.

Who it's for

ImmuniWeb is a strong fit for organizations that need recurring web, API or mobile scanning alongside exposure monitoring, or that want a separately scoped penetration test. Its Community Edition also gives smaller organizations a way to run basic online security and exposure checks without a subscription. It is less compelling for buyers seeking only a free standalone scanner or a low-cost, limited-scan service.

Pros and cons

• Pros: Neuron subscriptions allow unlimited scans per app or target, supporting repeated checks without a per-scan quota.
• Pros: Discovery combines attack-surface, third-party and dark-web monitoring with API access, exports and expert assistance.
• Pros: Community Edition covers several online checks at no cost, including mobile app security.
• Cons: Discovery has a one-year standard subscription duration and a 10,000-asset-and/or-incident cap before flexible additional pricing applies.
• Cons: On-Demand tests start at €5,995 per test, which is a substantial outlay for a single engagement.
• Cons: Monthly Neuron subscriptions cost more than the stated annual subscriptions, so buyers who need flexibility pay a premium.

Alternatives

For a different approach to application and exposure security, consider these options:

• Nuclei is a free, MIT-licensed open-source CLI, primarily intended as a standalone tool; choose it if a free command-line scanner is a closer fit than ImmuniWeb's broader paid platform.
• Beagle Security offers a free plan with one lite test per month, monthly surface scan reports, and SSL and domain-expiry monitoring; its Essential plan is $99 a month, billed Billed $1188 annual. Consider it if that smaller free allowance or lower-priced entry point fits better.
• Detectify Surface Monitoring has a free Starter plan for up to 5 users and 1 team, with Surface Monitoring costing extra per domain; choose it if those team limits and per-domain model suit your needs.
• Qualys External Attack Surface Management includes CSAM with EASM at no cost for 30 days; consider it for a time-limited trial of external attack-surface management.
• ZeroThreat provides five free scan credits on sign-up, valid for 15 days, then one scan credit per month and one target per account; it may fit a buyer who only needs a narrowly capped scan allowance.
• OWASP ZAP is free and open source; choose it if an open-source tool is the priority.
• Wapiti is a free and open-source scanner under GNU GPL version 2; it is another option for buyers seeking free software.
• Pentest-Tools.com API Scanner is an alternative for buyers comparing API scanning options.

Explore Web Application Security Scanners, Security Ratings Software and Attack Surface Management Software for more options by category.

Verdict

Choose ImmuniWeb if your organization needs repeatable application scanning, broader exposure monitoring or a paid penetration test in one platform, and the relevant target-based or annual pricing fits the work. Its unlimited repeat scans and broad Discovery scope are the strongest reasons to choose it. Look elsewhere if you need only a free standalone scanner, a modest scan-credit plan or a less substantial commitment for ongoing monitoring.