Pricing
Pricing and features — all published here, on this page.
What each plan does
Start free to see what is exposed from the outside; move to PentaTrail CTEM when you need to know what to act on first. Here is exactly what's in each.
| Compare | ASM (Free)DiscoverStart for free | CTEM (Paid)Prioritize · Remediate · VerifyApply for PentaTrail CTEM |
|---|---|---|
| Monthly price (excl. tax) | $0 | $215 |
| Registered domains | Up to 1 | 1 included, more available |
| Additional domains | — | $140/month |
| Users per organization | Up to 5 | 5 included (additional users available) |
| Additional users | — | $25/month |
| Subdomains | Unlimited | Unlimited |
| Observation frequency | Monthly observation | Daily observation |
| Discovery of internet-facing assets | ||
| Detection of known vulnerabilities that may apply | ||
| AI assessment of asset importance | — | |
| Risk levels and prioritization | — | |
| AI remediation guidance | — | |
| Tracking resolution and re-detection | — | |
| Notifications | — | |
| MCP integration with approved AI agents | — | |
| Credit card | Not required | Required when you apply |
The user limit is shared across the organization, not assigned separately to each service.
How pricing works
Pricing is per domain. Everything under a registered domain is included, no matter how wide it grows.
Billed per domain
ASM: free for up to 1 domain / CTEM: $215/month / 1 domain and 5 users included
Unlimited subdomains
Every subdomain found under a registered domain is monitored at no extra charge, with no cap.
Same price as subdomains grow
Billing is per origin domain. As more subdomains are found under a registered domain, no additional fees apply.
Add-ons (PentaTrail CTEM only)
| Item | Price |
|---|---|
| Additional domain (from the 2nd) | $140/mo |
| Additional user | $25/mo |
All prices are per month in USD, excluding tax.
Security assessment and ASM costs
Security spend is counted two different ways: a one-off assessment you commission, and continuous monitoring you subscribe to. This page puts both cost bands on one screen and explains what each price actually buys you.
Service types and rough cost
| Type | Price band |
|---|---|
| Free single-scan (Vendor F)Scans one site for free or a low fee. No asset discovery or continuous monitoring. | Free–~$2/mo (no discovery, single site) |
| Commissioned assessment, tool-ledA one-off assessment driven by automated scanning. No asset discovery or continuous monitoring. | from ~$2,000 per assessment (published guide price) |
| Commissioned assessment, expert-manualSpecialists work through the target by hand. Scope and depth move the price a lot. | from ~$6,800 per assessment (published guide price) |
| Self-serve tool (Vendor A)You operate the tool yourself to scan and monitor. Operations are on you. | Self-serve from ~$270/mo / assisted from ~$800/mo (human) |
| Per-domain (Vendor B)Attack-surface management (ASM) contracted and billed per domain. | ~$300/mo per domain |
| Continuous human analyst (Vendor C)Analysts scan and report on an ongoing basis. Hands-on, but expensive. | from ~$2,000/mo |
| AI scan (Vendor D)AI scans apps and code and even proposes fixes (more app/code testing than external attack surface). | from ~$470/mo |
| Suite / inquiry-based (Vendor E)Bundles several capabilities. ASM pricing is inquiry-based. | ASM: inquiry / scan from ~$330/mo |
| Global low-cost SaaS (English-only)Self-serve SaaS with English-only UI and support. | $99 / $129 / €82–302 (monthly, 3 services) |
| Global majors (English, enterprise, annual)Global enterprise attack-surface tools. Enterprise-oriented, annual contracts, pricing on inquiry. | thousands of $/mo (undisclosed, annual, inquiry) |
| PentaTrailAI-native attack-surface management. Not just finding it — what to fix first, and how — at this price. | PentaTrail CTEM $215 (1 domain, 5 users; unlimited subdomains). PentaTrail ASM is $0 for up to 1 domain |
Which type should you pick?
It comes down to your current setup and how much you want automated. Read the ones that apply.
Cost is the overriding concern
A free single-scan service is the candidate. It does no asset discovery and no continuous monitoring, so you will not see the whole attack surface. If you have one site and it rarely changes that is enough, but once assets multiply or appear without anyone telling you, PentaTrail ASM keeps track of what is visible from the outside (move to PentaTrail CTEM at $215/mo when you also want it ranked and the fix advice).
You want to run it yourself
A self-serve tool automates discovery and monitoring. If you have someone to operate it and you want to keep judgement calls in-house, this is the fit. If you would rather hand over ranking and the fix advice too, that is PentaTrail CTEM ($215/mo).
You want people alongside you
A continuous human analyst service runs roughly $800–$2,000/mo. If you want judgement shaped around your business, and someone to speak to it in a board meeting, that price has a reason behind it. If you want the same prioritisation and guidance driven by AI, that is PentaTrail CTEM at $215/mo.
You need the coverage and track record of a global major
A global major is the candidate. Discovery and detection cover a wide surface and the service catalogue is broad. Expect an annual contract running into thousands of dollars per month, with an English-only UI and support. If you want discovery, monitoring, risk ranking and the fix advice for $215/mo instead, that is PentaTrail CTEM.
Once it is found, you want AI to tell you what to fix first
PentaTrail fits. PentaTrail ASM (free) covers seeing what is exposed from the outside and detecting known vulnerabilities that may apply; PentaTrail CTEM ($215/mo) adds risk ranking (TER), the AI remediation guidance, and notifications with MCP access.
Feature & coverage comparison
| PentaTrail CTEM ($215) | Vendor F (free single-scan) | Vendor A (self-serve tool) | Vendor B (per-domain) | Vendor C (human analyst) | Vendor D (AI scan) | Vendor E (suite) | Global low-cost SaaS (English) | Global majors (English, enterprise) | |
|---|---|---|---|---|---|---|---|---|---|
| Automated asset discovery | ◎ | ✕ | ◎ | ◎ | ◎ | — | ◎ | ◎ | ◎ |
| Continuous monitoring & diff | ◎ | △ | ◎ | ○ | ○ | ○ | ◎ | ○ | ◎ |
| Detect & rank vulnerabilitiesOrder found issues from most to least dangerous | ◎ | ○ | ◎ | ○ | ◎ | ○ | ◎ | ◎ | ◎ |
| AI remediation guidanceGroups findings by remediation approach and shows concrete remediation steps | ◎ | ✕ | ✕ | — | — | ○ | △ | △ | △ |
| AI-native + MCPOperate it from an AI agent over MCP | ◎ | ✕ | ✕ | — | — | ○ | ✕ | ✕ | △ |
| Evidence you can seeShows why it is risky, and it can be audited | ○ | △ | ○ | — | — | ○ | ○ | ○ | △ |
| Price (starting monthly) | $215 | Free–~$2 | from ~$270 | ~$300/domain | from ~$2,000 | from ~$470 | from ~$330 (ASM: inquiry) | $99 / $129 / €82–302 | thousands of $ (inquiry) |
| Pricing transparency (can you pin the total?) | ◎ | ◎ | △ | ◎ | △ | △ | ✕ | △ | ✕ |
Based on each vendor's public information (as of August 2026). "✕" means a vendor does not officially advertise it; "—" means it could not be confirmed from public information (not necessarily unsupported). "Pricing transparency" marks a flat, pin-downable total as ◎ and a from-only figure as △. "Global majors" is a grouped column of several English, enterprise services with undisclosed (annual, inquiry-based) pricing. Competitor prices are approximate conversions of published prices (mostly JPY).
Last updated: 2026-08-07
Can you predict the bill?
The dividing line is whether you can predict your bill as your attack surface — the sites you monitor, hosts like shop.example.com — grows.
| Billing model | Predictability |
|---|---|
| PentaTrail (billed per domain) | Flat. You pay by the number of domains ($215 = 1 domain included, +$140 per additional domain from the 2nd). Every subdomain under a domain is included with no cap, so adding subdomains never changes the price. You can total it from the public prices alone. |
| Billed per asset (site) | The more sites you monitor, the higher the price. The total often requires a sales inquiry, and cost gets harder to predict as your attack surface grows. |
Frequently Asked Questions
How much is PentaTrail CTEM?
PentaTrail CTEM is $215/month. It includes 1 domain and 5 users; every subdomain found under those domains is monitored at no extra charge, with no cap. From the 2nd domain, each additional domain is $140, and each additional user is $25.
How many subdomains can I monitor?
There is no cap. Billing is per domain: register a domain and every subdomain found under it is monitored at no extra charge. You can work out your total from the prices on this page alone ($215 + $140 per additional domain from the 2nd).
Can I see pricing before signing up?
Yes. PentaTrail CTEM at $215/month, along with included quantities, add-on fees, and what PentaTrail ASM covers, are all on this page.
What do these services typically cost?
For external attack-surface management, self-serve tools start around $270/mo, per-domain billing around $300/mo, and continuous human-analyst services around $2,000/mo. PentaTrail CTEM is $215, and PentaTrail ASM is $0.
Should I start on PentaTrail ASM or PentaTrail CTEM?
Start free with PentaTrail ASM. No credit card is needed, and you continuously see what is exposed from the outside for the domain you register. Move to PentaTrail CTEM ($215/mo) when you want risk ranking so you know what to act on first, AI remediation guidance, and notifications with MCP access.
How is this different from a continuous human-analyst service?
Continuous human-analyst services run about $800–$2,000/mo. PentaTrail automates the same prioritization and remediation guidance with AI and delivers it on PentaTrail CTEM at $215/mo.
Is a one-off assessment cheaper than continuous monitoring?
They are counted differently, so they do not compare directly. A commissioned assessment starts from about $2,000 per assessment when it is tool-led, and from about $6,800 per assessment when specialists work by hand. Continuous external attack-surface monitoring is monthly; PentaTrail CTEM is $215/mo. An assessment inspects an agreed scope deeply, once. Continuous monitoring starts from the domains you register, widens automatically to assets externally related to them, and keeps observing them continuously (unrelated domains still have to be added by hand). They confirm different things.
Last updated: 2026-10-06