Pricing
Pick a plan that replaces what you'd otherwise spend on quarterly scans or annual consulting engagements.
Kick the tyres on your own infrastructure.
Evaluation only, not for compliance use
Replace your quarterly external scan.
On-demand scanning for a solo developer
Replace your annual pentest engagement.
Security in your pipeline — teams shipping continuously
A continuous pentest programme.
Mid-market SaaS, regulated industries
Proof, not promises
We ran a Standard-tier scan against OWASP Juice Shop. 13 minutes, 11 confirmed findings including a critical SQL injection chain and a JWT key exposure path to admin takeover. Full report walkthrough on the blog.
No subscription
One-off Deep pentest for engineering teams or compliance workstreams. Pay once, verify your target, get a polished report. No subscription, no auto-renewal.
One Deep authenticated network pentest + narrative report. Roughly 1/5 the price of a human consulting engagement.
Network pentest plus source-code, dependency, and git-history review. Roughly 1/3 the price of a combined consulting engagement.
Compliance-grade pentest deliverable for SOC 2, ISO 27001, and Series-A diligence. Anchored at ~1/4 of typical audit-prep pentest spend.
Traditional DAST products run a fixed list of signature checks and hand you a list of CVEs. Pwnkemon runs a suite of battle-tested detection engines under the hood (port + service discovery, HTTP/TLS fingerprinting, 13,000+ CVE/exposure/misconfig templates, headless-browser crawling, dependency + IaC scanning, git-history secret detection, and SAST) and chains them with an LLM agent that reasons about what to probe next, surfaces multi-step attack chains, and writes a narrative report. The output is closer to what you'd get from a human pentest consultancy, at roughly 1/100th the price.
Pwnkemon runs its own named modules, each wrapping a battle-tested detection engine: Portmap for port + service discovery, Fingerprint for HTTP/TLS fingerprinting, Templar for ~13,000 CVE + exposure + misconfiguration templates, Prowl for headless-browser crawling (SPAs work), DepScan + VulnDB for dependency CVEs and IaC, Leakhound for secrets in git history, CodeSift for SAST, NodeAudit for the Node ecosystem. The agent picks which modules to run based on what it finds, rather than running everything blindly. See the docs/scan-tiers page for the per-tier breakdown.
You must verify ownership of every target before scanning. Verification is a one-time DNS TXT record or HTTP file challenge. This protects you legally and us from abuse. Subdomains of a verified target are auto-authorised.
Code scans (deps, SAST, secrets, IaC) cost 1 credit — scan your repos as often as you like; the limit is how many repos your plan covers. Web/network scans are credit-metered by depth. On Quick (10 credits, ~1 min): port discovery, TLS check, HTTP fingerprinting. On Standard (50 credits, 4–12 min): everything Quick does plus Templar templates and Prowl crawling against your target. On Deep (100 credits, 10–25 min): Standard with deeper iteration, longer crawl, Claude Opus for triage, and a verification pass over every finding. Reports include attack chains, severity reasoning, evidence, and prioritised remediation.
We run Pwnkemon publicly against OWASP Juice Shop (a known intentionally-vulnerable lab). The full report walks through 11 confirmed findings including a critical SQL injection chain, exposed JWT signing key, and Prometheus metrics leak, all produced in 13 minutes. See: /blog/juice-shop-real-scan.
Every scan produces Markdown, HTML, PDF, and CSV exports. Download from the dashboard, or POST to a webhook on completion for CI/CD pipelines. Free-tier reports auto-delete after 7 days and carry a watermark; paid tiers retain reports forever and produce clean, auditor-ready output.
Then your infrastructure is in better shape than most. Pwnkemon also produces a coverage report showing exactly what was tested, which is itself valuable for compliance audits as proof of due diligence.
For a one-off engagement: the $7,999 SOC 2 Evidence Pack is the right SKU. It's a Deep network scan plus code scan plus auditor-ready framing with control-mapped evidence (CC6.1, CC7.1, etc). That's anchored at roughly 1/4 of typical audit-prep pentest spend, and the deliverable is functionally equivalent. For continuous monitoring: Business and Enterprise subscriptions include scan history, finding remediation tracking, and the continuous-monitoring artefacts auditors expect.
Yes. Monthly plans cancel any time, no questions. Annual plans give you 20% off for committing upfront; cancel mid-term and you keep access until renewal.
No credit card required. Verify a domain, launch a scan, see a report.
Comparing options? See the AI pentesting tools compared.