- Home
- Web Application Security Scanners
- ZeroThreat
ZeroThreat
United States
What it is
ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs, available through web and API access. It continuously searches for vulnerabilities, attempts exploits, and validates findings with reproducible proof that includes request and response evidence and exact payloads. Web testing supports authenticated workflows, including SSO, MFA, and role-based access, and rendering for React, Vue, and Angular single-page apps. API testing covers REST, GraphQL, SOAP, and gRPC, including internal APIs and shadow endpoints. ZeroThreat says it detects more than 130,000 vulnerabilities across sources including OWASP, CWE/SANS, Nuclei, and monthly updated CVE intelligence. Integrations cover CI/CD, project management, and messaging tools, connected through native connectors, APIs, or webhooks. On-premises deployment is listed as air-gap ready. The free plan includes five scan credits on sign-up, valid for 15 days, then one scan credit per month for one target. Professional costs $100 a month. Pay Per Scan costs $125, paid once, with five credits valid for one year.
For and against
For
- Supports authenticated web-app testing, including SSO and MFA.
- Covers REST, GraphQL, SOAP, and gRPC APIs.
- Provides reproducible exploit evidence.
- Lists air-gap-ready on-premises deployment.
- Connects with CI/CD, project, and messaging tools.
Against
- Free sign-up credits expire after 15 days.
- Free plan limits accounts to one target.
- Professional costs $100 a month.
- Pay Per Scan costs $125, paid once.
The verdict
ZeroThreat combines web and API penetration testing with evidence for validated findings and a range of integrations. Its free plan is limited, and the paid options have distinct billing terms.
Who it suits
ZeroThreat suits security, DevOps, and development teams looking to test web applications or APIs. Its listed use cases also include SaaS companies, MSSPs, and startups.
Plans and prices
Free
1 scan credit per month · 1 target per account · limited vulnerability-insights preview · web applications and APIs
Read 30 Sep 2026 · zerothreat.ai
Professional
Target-based unlimited scans · scheduled scans · 130K+ vulnerability coverage · unlimited retesting
Read 30 Sep 2026 · zerothreat.ai
Pay Per Scan
Unlimited targets · 7-day unlimited retest window · point-in-time compliance reporting
Read 30 Sep 2026 · zerothreat.ai
On the record
- API testing
- API pentesting covers REST, GraphQL, SOAP, and gRPC APIs, including internal APIs, shadow endpoints, BOLA, and BFLA.zerothreat.ai · read 30 Sep 2026
- Company identity
- The legal entity is ZeroThreat, Inc., a U.S.-registered corporation.zerothreat.ai · read 30 Sep 2026
- Coverage
- ZeroThreat states that it detects more than 130,000 vulnerabilities, including OWASP, CWE/SANS, Nuclei, and monthly updated CVE intelligence.zerothreat.ai · read 30 Sep 2026
- Deployment
- The homepage lists on-premises deployment as air-gap ready for full data sovereignty.zerothreat.ai · read 30 Sep 2026
- Documentation
- ZeroThreat provides a Help Center with getting-started, quick-scan, authenticated-scan, and login-sequence documentation.help.zerothreat.ai · read 30 Sep 2026
- Exploit validation
- The platform provides reproducible exploit proof with request/response evidence and exact payloads for findings.zerothreat.ai · read 30 Sep 2026
- Integration methods
- Integrations connect through native connectors, APIs, or webhooks, with no-code guided setup and API or CLI customization.zerothreat.ai · read 30 Sep 2026
- Integrations
- Integrations include GitHub Actions, GitLab, Jenkins, Azure Pipelines, CircleCI, TeamCity, AWS CI/CD, Bamboo, Travis CI, Jira, Asana, Slack, and Microsoft Teams.zerothreat.ai · read 30 Sep 2026
- Product
- ZeroThreat is an AI-powered autonomous penetration-testing platform that continuously discovers, exploits, and validates vulnerabilities across web applications and APIs.zerothreat.ai · read 30 Sep 2026
- Scan timing
- The pricing FAQ says scans typically complete in 30 minutes to 2 hours depending on the application, with scans starting within minutes.zerothreat.ai · read 30 Sep 2026
- Security controls
- The security architecture describes IAM, MFA, network segmentation, TLS 1.3 in transit, Azure Key Vault encryption at rest, and continuous monitoring.zerothreat.ai · read 30 Sep 2026
- Security standards
- ZeroThreat states that it complies with GDPR, HIPAA, and PCI DSS and aligns its security measures with ISO 27001 guidelines.zerothreat.ai · read 30 Sep 2026
- Use cases
- ZeroThreat presents use cases for enterprise security teams, DevOps and security teams, SaaS companies, developers, MSSPs, and startups.zerothreat.ai · read 30 Sep 2026
- Web testing
- Web-app pentesting supports authenticated workflows, SSO, MFA, role-based access, and Playwright rendering for React, Vue, and Angular SPAs.zerothreat.ai · read 30 Sep 2026
