Trial

A trial that runs against a target of your own

$299 buys one scan of one application or target on the self-serve card flow — the same six phases, and the same evidence behind every finding, as an engagement bought at the $500 entry price. There is no sample application in it.

Run a scan What one scan covers

Two trials

Only one of them has a button

They are different things, and the difference is worth knowing before you go looking for a control that is not there. One is bought on a card without a sales conversation. The other is arranged on a call, and only on a call.

Trial	How you get it	What it is
Paid trial, $299	Run a scan	One scan of one application or target, bought on the self-serve card flow without a sales conversation, in one of the five coverage classes that flow reaches.
Free trial	Request a call	Sales-qualified only. It is agreed in a conversation about your estate rather than issued on request, and there is no free-trial button anywhere on this site.

Paid trial, $299

How you get it: Run a scan
What it is: One scan of one application or target, bought on the self-serve card flow without a sales conversation, in one of the five coverage classes that flow reaches.

Free trial

How you get it: Request a call
What it is: Sales-qualified only. It is agreed in a conversation about your estate rather than issued on request, and there is no free-trial button anywhere on this site.

If the free route is the one you want, ask for it directly — the contact page reaches the same people who scope engagements, and it is a shorter path than working out which button on this site might have been the free one.

The comparison

A free penetration test exists in this category

One platform in the competitive set gives away a complete penetration test with no card at all. Conceded, plainly, because you would find it in the time it takes to open a second tab — and nothing further on this page argues with it.

What is worth saying instead is the other half of the sentence, which is what the $299 is spent on. It is spent on a target you nominate and authorise: your application, your API, your release build. The six phases that run against it are the six that run against a bought engagement, and every finding that comes back carries the request, the response and the steps that reproduce it.

That is the thing to compare, and it is not the price on its own. A run against the application you are shipping this quarter is the only run that tells you what is wrong with it, and that is what the $299 is spent on.

The run

What $299 actually sets in motion

In the order it happens: what is fixed before anything starts, what runs, and what you are left holding when it finishes.

01 Before it runs

One target of yours, and nothing deployed to reach it

What you nominate: One application or target. That is the same unit every other scan is sold in, so a trial scan and a bought scan are the same size of thing.
What has to be true of it: The coverage class has to be one the self-serve card flow reaches. Where it is not, the scan is still run — it is scoped on a call first rather than bought on a card.
What gets deployed: Nothing inside your network. External and application testing needs no deployed position at all, and internal testing, which does, is not a class the card flow reaches.

02 The run

Six phases, and the sixth runs on the finished report

The five that do the work: Discovery, planning, scanning, exploitation, reporting. Each one feeds the next, and exploitation is where a candidate stops being a signature match and becomes a finding somebody can reproduce.
The sixth: QA, run on the finished report before it reaches you. It is a phase of the engagement rather than a read-through at the end, which is why reporting is not the last thing that happens.
What the trial changes about them: Nothing. The same six phases run, in the same order, against a trial target as against any other. The price is the variable here; the method is not.

03 What you keep

Evidence per finding, and a closure that is an event

Behind every finding: A reproducible exploit artefact: the request that produced it, the response that came back, and the steps to reproduce. Severity as a CVSS v4.0 vector, and the CWE it maps to.
Afterwards: Findings carry open, fixed, retested and closed. A finding closes on a retest that cannot reproduce it, which is a different event from somebody marking it done.
Why this is the half worth paying for: A finding an engineer can act on without asking what it means, and a closure they cannot argue with. That object is what the $299 buys, and it is the same object a $500 scan buys.

The phase sequence is described in full on how it works, and what an individual finding has to survive before it is written down is on validation and proof.

What the card flow reaches

Five classes, on a card

These are the coverage classes a trial can be bought for without speaking to anybody. Each links to its own page, where the defect classes, the standards and the worked example for that class are set out.

Coverage class	What one scan of it is
Web application	The application you nominate, and a login for each role that exists inside it — one user’s reach is only testable against another user’s.
Mobile app	The build you already published, signed as it stands, pulled apart and read back without anybody handing over source.
API	One interface, and the question of what each route is meant to allow — settled on paper first, then put to every route in turn.
Thick client	The package you ship, on the assumption an attacker already holds a copy of it, and the server behind it tested on that assumption.
Secure code review	One codebase rather than one running copy of it, which is why a finding arrives as a line of code and the edit that shuts it.

Web application

What one scan of it is: The application you nominate, and a login for each role that exists inside it — one user’s reach is only testable against another user’s.

Mobile app

What one scan of it is: The build you already published, signed as it stands, pulled apart and read back without anybody handing over source.

API

What one scan of it is: One interface, and the question of what each route is meant to allow — settled on paper first, then put to every route in turn.

Thick client

What one scan of it is: The package you ship, on the assumption an attacker already holds a copy of it, and the server behind it tested on that assumption.

Secure code review

What one scan of it is: One codebase rather than one running copy of it, which is why a finding arrives as a line of code and the edit that shuts it.

The other six — external network, internal network, cloud, Active Directory, social engineering and applications built on a language model — are scoped on a call before they run. Each needs something agreed first: a deployed position, an authorisation naming a population, a movement boundary. That is a routing rule rather than a coverage one. All eleven classes are tested, all three delivery models cover all eleven, and the coverage index lists every one of them.

After it

One scan is one scan

The trial buys a single scan of a single target. Outside the trial, the entry price for one scan of one application or target is $500, and it is paid the same way, on the same flow, for the same five classes.

Beyond one target, three things move: how many targets or applications are in scope, how often they are tested, and which delivery model the engagement runs in — whether a senior auditor verifies each finding, or runs the engagement outright with B-52 underneath. Those three settle an estate faster in conversation than a page can guess at. What one scan covers sets out the unit and the axes, and the delivery models page explains whose signature each one puts on the report.

The two published figures, and what they cover As of September 2026

$299 is the trial: one scan, one target, bought on the self-serve card flow.
$500 is the entry price for one scan of one application or target outside the trial.
One scan is one application or target, inside the trial and outside it. The unit does not change with the price.

Deliberately excluded

Every figure above the entry price. The number of targets, the test frequency and the delivery model all move it, and the combination is settled on a scoping call rather than published as a range.

Pick one target and start there

Where the report has to carry an auditor’s signature, or the estate is larger than one application, the call is the shorter route. Everything else starts with a card and a target.

Run a scan Request a scoping call