ZeroThreat
ZeroThreat is an AI-powered automated penetration testing platform for web applications and APIs. It runs business-logic-aware DAST scans, validates exploitability with reproducible proof and delivers audit-ready remediation reports, with no configuration required.
What is ZeroThreat?
ZeroThreat is a software-as-a-service platform for automated penetration testing of web applications and APIs, published by ZeroThreat, Inc, a Delaware company. It positions itself as an agentic AI-driven DAST engine built around exploitability rather than signature matching: instead of comparing payloads against known patterns, the engine reasons about the application's logic, chains multi-step attacks and validates each finding with reproducible proof. The announced detection scope covers the OWASP Top 10, the OWASP API Top 10, the CWE/SANS Top 25 and business logic flaws, across what the publisher describes as more than 130,000 vulnerabilities. Named categories include SQL injection, cross-site scripting, XML, XPath and XQuery injection, format string and null byte issues, command injection, SSRF, session fixation and hijacking, unvalidated redirects, SSL/TLS misconfiguration, sensitive data exposure, directory indexing, fingerprinting, file inclusion and vulnerable JavaScript dependencies. On the API side it tests REST, GraphQL, SOAP and gRPC interfaces, internal ones included, and discovers undocumented shadow APIs on its own. Authenticated testing relies on login sequences, MFA handling and an in-house Chrome extension called Recorder that captures pages and actions, while Playwright support covers single-page applications and JavaScript-heavy interfaces. Scans are described as production-safe, meaning they can run against live applications without disrupting real users. The publisher claims first results within minutes and full coverage in thirty minutes to two hours depending on size, against two to four weeks for a manual engagement, along with 99.9% accuracy, ten times the speed of traditional DAST and ninety percent less manual pentesting. These figures are published by ZeroThreat without an accompanying methodology. Deployment is either multi-tenant SaaS or an on-premise, air-gapped installation for sovereign environments, and customers choose the region where scans execute and results are stored. Existing tooling can be reused: Burp Suite extensions, Nuclei templates and OWASP ZAP-compatible payloads run alongside the agentic engine. Reports are audit-ready and mapped to GDPR, HIPAA, PCI-DSS and ISO 27001, while the internal security programme is presented as aligned with ISO/IEC 27001, SOC 2 and a Zero Trust architecture rather than certified. The site claims adoption by more than 5,000 organisations and flags its Agentic AI Pentesting module as upcoming.
What it does
- Detect and validate vulnerabilities across web applications and APIs, with coverage of more than 130,000 issues claimed by the publisher.
- Confirm that a finding is genuinely exploitable through controlled exploitation, with reproducible proof.
- Discover endpoints and shadow APIs automatically across REST, GraphQL, SOAP and gRPC interfaces.
- Test authenticated journeys, roles and permissions, including BOLA, BFLA and IDOR flaws.
- Produce audit-ready compliance reports mapped to GDPR, ISO 27001, PCI-DSS and HIPAA.
- Trigger scans from the CI/CD pipeline on every push or pull request, and retest a single vulnerability to verify a fix.
- Choose the region where scans execute and where results are stored.
When to use ZeroThreat / When not to
A quick filter to help you decide if ZeroThreat is the right fit.
When to use ZeroThreat
- Product and DevOps teams with no in-house security specialist: scanning starts from a URL, with no agent to install and no security expertise assumed.
- SaaS vendors and startups that ship frequently and want a security check on every build rather than once a year.
- Enterprise security teams that need reproducible exploit evidence and control over the region where scans run and results are stored.
- MSSPs and consultancies producing GDPR, HIPAA, PCI-DSS or ISO 27001 compliance reports across several client estates.
- API-heavy engineering teams working with REST, GraphQL, SOAP, gRPC and internal APIs, including modern single-page applications tested through Playwright.
When not to use ZeroThreat
- Teams looking for source code analysis: ZeroThreat is a dynamic tester, with no SAST, no binary analysis and no broad network infrastructure scanning.
- Native mobile application security testing, which falls outside the platform's web and API scope.
- Organisations that must keep a full manual penetration test: the publisher itself concedes that some companies will still run annual compliance engagements.
- Individuals and non-technical users: the product addresses engineering, DevOps and security teams, and the services are not intended for anyone under 16.
- Large estates on a tight budget: every subdomain counts as a separate target and is billed as such, and the free plan only shows a limited preview on a single target.
How to use ZeroThreat
A typical end-to-end flow, from setup to results.
- Create an account at app.zerothreat.ai/sign-up: no credit card is required, and five scan credits are granted on sign-up, valid for fifteen days.
- Add a target, meaning a single domain or subdomain; app.example.com and docs.example.com count as two separate targets.
- Verify ownership of the target, then optionally set custom headers and choose a scan profile.
- Launch an unauthenticated scan straight away to get a first picture of the exposed surface.
- For anything behind a login, configure a login sequence, supply an MFA-enabled account, or record pages and actions with the Recorder Chrome extension, using dedicated test accounts rather than production ones as ZeroThreat recommends.
- For APIs, create a collection from an OpenAPI, Swagger, Postman or GraphQL specification, then run an authenticated or unauthenticated API scan.
- Read the report section by section: summary, web vulnerabilities, API vulnerabilities, information exposure, SSL certificate, vulnerable versions, server ports and compliance.
- Retest an individual vulnerability to confirm a fix, without re-running the whole scan.
- Schedule recurring scans and wire the platform into CI/CD, with GitHub Actions, GitLab, Jenkins, AWS CI/CD, Azure Pipelines or CircleCI, to scan on every push or pull request.
- Push findings to Jira, Azure Boards, GitHub Issues, GitLab Issues or Trello, route alerts to Slack or Microsoft Teams, and share branded reports with the team; step-by-step documentation sits on help.zerothreat.ai/docs.
Pros & Cons
Pros
- Point-and-click start: a URL is enough, with no agent to install and no security expertise assumed.
- Findings are backed by exploitability validation and reproducible proof, which cuts the false-positive noise typical of signature scanners.
- Web and API testing sit in the same tool, GraphQL, SOAP, gRPC and internal APIs included.
- Business logic and access control testing addresses a classic blind spot of pattern-matching scanners.
- Short feedback loop: first results in minutes and full coverage in thirty minutes to two hours, according to the publisher.
- A permanent free plan with one credit a month plus five credits on sign-up and no credit card, and, according to the integrations FAQ, every integration is available on every plan.
- Data governance options are unusually explicit: scan and storage region control, on-premise or air-gapped deployment, a written no-training commitment extended to third-party LLM providers, and detailed public product documentation.
Cons
- Per-target pricing adds up quickly on a wide estate: every subdomain is a separate target, at $100 a month for the first and $75 for each additional one.
- ISO/IEC 27001 and SOC 2 are announced as security programme alignment, with no attestation, report or trust centre published anywhere on the site.
- The headline performance figures, namely 99.9% accuracy, ten times faster and 130,000+ vulnerabilities, are publisher claims with no published methodology.
- No public API documentation exists, even though the integrations FAQ mentions API and CLI access for deeper customisation.
- The Enterprise tier publishes no price at all, and the selectable scan and storage regions are never enumerated publicly.
- No support email address is published: support runs through a contact form and the help centre, and subprocessors are named inside the privacy policy rather than on a dedicated maintained page.
- The free plan only gives a limited preview of detected vulnerabilities on a single target, no interface language other than English is announced, and the Agentic AI Pentesting module is still marked upcoming.
Pricing & Plans
ZeroThreat offers a permanent free plan, limited to one scan credit a month on a single target with a restricted preview of findings, together with five scan credits granted on sign-up and valid for fifteen days, without a credit card. The lowest recurring paid entry point is the Professional plan at USD 100 per target per month, with additional targets charged at USD 75 each; annual billing is advertised at a 20% saving. A non-subscription option, Pay Per Scan, starts at USD 125 for a bundle of five credits, that is USD 25 per credit, valid for one year, with automatic volume discounts. An Enterprise tier exists but no price is published. Prices are stated exclusive of taxes, and subscriptions renew automatically unless cancelled with 30 days' written notice. Visa, MasterCard, American Express and bank transfer are accepted.
- USD 0 - one scan credit per month
- one target
- limited preview of detected vulnerabilities
- web and API coverage
- OWASP Top 10 and CWE detection
- authenticated scanning
- and the same detection engine as the paid plans
- with no configuration required.
- USD 100 per target per month
- USD 75 per additional target
- annual billing advertised at a 20% saving
- flagged Best Value - unlimited scans per target
- scheduled and concurrent scans
- AI remediation and executive summaries
- sensitive data and cloud misconfiguration detection
- 130K+ coverage (OWASP
- USD 125 for five credits
- that is USD 25 per credit
- valid one year - unlimited targets
- AI remediation and executive summaries
- sensitive data and cloud misconfiguration detection
- a 7-day unlimited retest window
- popular CVE coverage
- authenticated scanning
- a tab on the pricing page with no public price
- on-premise and air-gapped deployment is discussed during enterprise onboarding.
Data, GDPR & hosting
A consolidated view of how ZeroThreat handles your data.
GDPR overview
GDPR implementation is documented in detail. The privacy policy, effective 29 April 2026, names the EU and UK GDPR alongside CCPA/CPRA, PIPEDA, LGPD, India's DPDP Act 2023, the Australian Privacy Act and POPIA. It states the legal bases (contract, consent, legitimate interests, legal obligation) and notes that in processor mode the basis is set by the customer. GDPR rights are listed in full, including an absolute right to object to direct marketing, with a one-month response window extendable by two. Transfers outside the EEA rely on the Commission's standard contractual clauses, the UK IDTA and EU-US, UK and Swiss Data Privacy Framework certifications. Breach notification is 72 hours to the supervisory authority as controller and 48 hours to the customer as processor. A DPA is available and Global Privacy Control signals are honoured. No Article 27 EU representative is named.
Who owns the data?
ZeroThreat's privacy policy splits its role in two. For the marketing website and prospect data it acts as a controller; for the platform itself it acts as a processor. In that second role the customer remains the controller of scan data, authorised user information and any personal data of its own end users that incidentally appears in results, and ZeroThreat states it processes them only on the customer's documented instructions, under the subscription and the data processing agreement. Customers can delete scans, projects or entire accounts at any time from the platform or by writing to netadmin@zerothreat.ai. Aggregated and de-identified data, however, may be kept indefinitely.
Reuse rights
Acting as a processor, ZeroThreat states it uses customer data only to deliver the platform: authentication, security and audit logging, support, and assistance with data subject requests. As a controller it uses website and account data to operate and secure the service, provide support, bill, send transactional and, subject to preferences, marketing messages, advertise through Google, Microsoft and LinkedIn, recruit, meet legal obligations and produce aggregated analytics. The policy carries an explicit no-training commitment: scan data, account data, authorised user credentials and personal data processed as a processor are not used to train, fine-tune or improve any general-purpose, foundational or shared AI model, whether developed by ZeroThreat or by a third party, without the customer's prior written consent. The third-party LLM providers named in the policy, namely OpenAI, Anthropic, Microsoft Azure OpenAI, Google Vertex AI and Amazon Bedrock, act as subprocessors under contracts that forbid them from training their own models on customer data. AI-generated recommendations are presented as informative support under human oversight, with no automated decision-making producing legal effects within the meaning of Article 22 GDPR. Scan credentials supplied by the customer are encrypted at rest, redacted from logs and AI prompts, and never displayed again in clear text. On the marketing website itself, Google Analytics 4, Google Ads, Microsoft Clarity, Microsoft Advertising, the LinkedIn Insight Tag, Zoho PageSense, Zoho SalesIQ and CookieScript are in use.
Data retention & training
Hosting summary
The publisher is established in the United States and states that it processes data in the U.S. and in other countries where it, its subprocessors or its customers operate. Cloud hosting is declared with AWS, Azure and GCP, all named as subprocessors. A preferred-region feature lets the customer choose where a scan runs and where security data is stored, in which case the data stays within the designated geography; the regions actually available, however, are never listed on the site, so no concrete list can be reproduced. An on-premise, air-gapped deployment is also offered, under which nothing leaves the customer's own infrastructure. Transfers outside the EEA are covered by the Commission's standard contractual clauses, the UK IDTA and Data Privacy Framework certifications. Encryption is TLS 1.2 or above in transit and AES-256 at rest for the production database, object storage and backups, backups are distributed across geographies, and multi-tenant isolation is logical at every layer.
Things to keep in mind
Risks and trade-offs to weigh before adopting ZeroThreat.
- Authenticated scanning means handing credentials to the platform. ZeroThreat encrypts them at rest, redacts them from logs and AI prompts and recommends dedicated test accounts, but delegating access to a live application remains a decision to weigh.
- One target equals one domain or subdomain, so the real cost depends on how many subdomains have to be covered, something the price grid does not put forward.
- Contractual details to note: subscriptions renew automatically unless cancelled with 30 days' written notice, changing a target URL on the Professional plan triggers a 30-day cooling period, free credits expire after fifteen days and never renew, and an account left inactive for twelve months can lose access and have its data deleted.
- ISO/IEC 27001 and SOC 2 are described as programme alignment, not as attested certifications; ask for the reports before relying on them for a regulatory commitment.
- The selectable scan and storage regions are never enumerated publicly, so confirm the region you need is actually offered before contracting.
- No Article 27 EU representative is designated, although the publisher is established in the United States and explicitly targets the European market.
- Delaware law governs the terms and disputes go to arbitration in Wilmington, which makes recourse from Europe impractical; scanning an application also requires authorisation to do so, and the terms place lawful use squarely on the customer.
Setup & Integrations
Technical difficulty
Low for the basic case, moderate beyond it. The SaaS mode needs no agent and no internal access: create an account, verify ownership of the target, enter a URL and scan. Authenticated scans require genuine configuration work, whether a login sequence, MFA handling or recording a journey with the Recorder Chrome extension, and API scans assume an OpenAPI, Swagger, Postman or GraphQL specification. CI/CD integration is documented step by step and advertised as code-free. On-premise deployment is a project in its own right: installation, DNS, licence management, AI and mail server configuration.
Deployment
Integrations
Behind ZeroThreat
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement ZeroThreat.
Frequently asked questions
What is ZeroThreat?
How does it differ from a traditional DAST scanner?
How long does a scan take?
Is there a free plan?
Can it scan behind a login?
What exactly counts as a target?
Does it fit into a CI/CD pipeline?
Is customer data used to train AI models?
Can the platform run on our own infrastructure?
Does it replace manual penetration testing?
Should you pick ZeroThreat?
ZeroThreat is a credible automated application penetration testing tool for engineering teams without a dedicated security specialist. Its real contribution sits where signature-based scanners stop: confirming that a finding is genuinely exploitable, and probing business logic and access control instead of matching payloads. Getting started is deliberately undemanding, a URL and an ownership check, while authenticated testing, API collections and CI/CD wiring are where the actual effort lies. The pricing model deserves attention before signing. At USD 100 per target per month it is economical across a handful of applications and expensive across a wide estate, since every subdomain counts separately. Pay Per Scan suits occasional audits, and the Enterprise tier publishes no price at all. Data governance reads seriously on paper: a written no-training commitment extended to third-party LLM providers, an available DPA, a choice of scan and storage region, and on-premise or air-gapped deployment for sovereign environments. What is missing is external proof. ISO/IEC 27001 and SOC 2 appear as security programme alignment, not as attested certifications, and no report or trust centre is published; the available regions are never listed either. Both are worth asking for in writing before a regulated commitment. The publisher is young: the domain was registered in October 2023, the first Wayback capture dates from January 2024, and no funding round has been announced. Headline figures such as 99.9% accuracy, ten times faster and more than 5,000 organisations are publisher claims without published methodology, and the fully agentic pentesting module is still flagged as upcoming. ZeroThreat itself concedes it does not entirely remove the need for a manual engagement. For a team shipping frequently, the free plan and the five sign-up credits make an evaluation cost close to nothing.
- Choosing a selection results in a full page refresh.
- Opens in a new window.