An exact quote for your scope
Tell us your developer count, edition and whether you need air-gap - you get an exact price and a 30-day PoC in your own environment.
You pay for your team - one developer, one price. Dynamic testing and Agentic Pentest, which scale with your external surface, are metered by target URL. Self-hosted, air-gapped-capable, annual. No free tier; a full 30-day proof-of-concept in your own environment.
Every edition is priced per developer / month, billed annually. Pick by the coverage you need; DAST and Agentic Pentest scale separately by target URL (below).
| Essentials | Platform | Enterprise | |
|---|---|---|---|
| Price | $35 / dev · mo | $70 / dev · mo | $90 / dev · mo |
| Best for | Code-security teams shifting left | A full AppSec program on one platform | Regulated, air-gapped, proof-of-exploit |
| Coverage | SAST · SCA · Secrets · IaC · Container | + DAST · Cloud posture · ASPM · API | + Agentic Pentest · Threat Modeling |
| Dynamic testing (DAST) | Add-on / URL | 5 target URLs | 10 target URLs |
| Agentic Pentest | Uplift on a DAST target | Uplift on a DAST target | On all 10 targets |
| Compliance | Every framework | Every framework | + Evidence vault |
| Air-gapped | Optional (+15%) | Optional (+15%) | Included |
| Support | Community | 8×5 priority | 24×7 + SLA + CSM |
List for our local market, on-prem annual licence; a separate list applies in the EU and GCC. Minimum $2,000 / $4,000 / $7,500 per year by edition. For a written quote, contact us.
Developers, edition and DAST target URLs are the whole bill for most teams. The math below uses the exact bands and rates published on this page - nothing is rounded for effect.
An estimate from this page's own published rates, not a quote - it does not know your multi-year or 100+ seat discount, or which region's list applies to you. Get a written quote.
Deployment is not a pricing tier. Every edition above is available in all three, with the identical feature set - the only thing that changes is who operates it.
Your infrastructure, your keys, air-gapped capable. Licence includes onboarding and support for the deployment you run.
Perpetual licence available for government buyers.
The same install in your AWS, Azure or GCP account. You pay your own infrastructure bill; the apPosture licence is unchanged.
No per-scan or per-finding metering, ever.
A dedicated single-tenant instance we operate. Hosting and operations are quoted on top of the edition price, based on region and scale.
Move it in-house later without losing history.
The platform is priced per developer - the bill tracks your team, not how many repositories or findings you have. Dynamic testing scales by the surface it reaches, so DAST and Agentic Pentest meter by target URL.
Platform includes 5 target URLs; Enterprise includes 10, with the Agentic Pentest uplift on all of them. Further targets bill at the band rate, and on Essentials every target is an add-on. A target URL is one registered scan target - a base host or application - not every crawled page.
Why per developer? A 2-developer team with 100 repositories pays for 2 developers - the bill tracks your team, and you can verify it against your source control.
All three are per developer / month, billed annually (local-market list). Subject to the per-edition minimum.
Platform includes five target URLs and Enterprise ten, with the Agentic Pentest uplift on all of them. Beyond the allowance, and on Essentials, targets bill per registered URL with volume bands.
| Target URLs | Per URL · yr | vs list |
|---|---|---|
| 1 - 10 URLs | $900 | list |
| 11 - 25 | $720 | ≈ 20% off |
| 26 - 50 | $560 | ≈ 38% off |
| 51+ | Custom | talk to us |
The rate falls as the team grows. Bands apply to the whole team, not marginally - a team of 110 pays the 101-250 rate on every developer. The last band is the floor, not the start of a negotiation downward.
| Active developers | Essentials | Platform | Enterprise |
|---|---|---|---|
| 10 - 25 | $35 | $70 | $90 |
| 26 - 100 | $32 | $64 | $82 |
| 101 - 250 | $29 | $58 | $74 |
| 251+ | $27 | $53 | $68 |
Agentic Pentest is an uplift of +$600 / URL · yr on a dynamic-testing target, not a separate purchase - it reasons over the surface the crawl produced, so it needs that target to exist. A single one-off engagement (one target, dynamic testing + Agentic Pentest, full report) is $900. Multi-year terms earn a further discount on top of the bands above. Minimum $2,000 / $4,000 / $7,500 / year by edition.
Grounded in what the platform does today - not a roadmap.
| Capability | Essentials | Platform | Enterprise |
|---|---|---|---|
| SAST · SCA · Secrets · IaC · Container | ✓ | ✓ | ✓ |
| AI assistant + verified fix PRs | ✓ | ✓ | ✓ |
| DAST - proof-of-exploit dynamic testing | add-on | 5 targets | 10 targets |
| API security - OWASP API Top 10 | - | ✓ | ✓ |
| Cloud posture (CSPM) | - | ✓ | ✓ |
| ASPM correlation + attack-chain graph | - | ✓ | ✓ |
| Risk-weighted posture (0-100, A-F, trend) | partial | ✓ | ✓ |
| Agentic Pentest - uplift on a dynamic-testing target | uplift | uplift | on all 10 |
| Evidence-based threat modeling (STRIDE) | - | - | ✓ |
| CI/CD gate | Monitor | Block + PR | Fail-closed |
| SSO (OIDC / SAML / LDAP) + SCIM | - | ✓ | ✓ |
| RBAC + multi-tenant | - | partial | ✓ |
| Compliance frameworks | ✓ | ✓ | ✓ |
| Tamper-evident evidence vault + auditor portals | - | partial | ✓ |
| Air-gapped deployment | +15% | +15% | Included |
| Support | Community | 8×5 priority | 24×7 + SLA |
| 📱 Mobile Security - iOS, Android, Flutter · MASVS + MASTG (any edition) | +$12 / dev · mo |
| API Security - OWASP API Top 10, schema drift, runtime inventory (included on Platform+) | +$15 / dev · mo |
| Dynamic testing (DAST) - crawl, active scan and deterministic proof, per target URL (5 included on Platform, 10 on Enterprise) | $900 / URL · yr |
| Agentic Pentest - hypothesis generation + agentic exploitation, added to a dynamic-testing target (included on all 10 Enterprise targets) | +$600 / URL · yr |
| One-off engagement - one target, dynamic testing + Agentic Pentest, full report, no subscription | $900 |
| Air-gapped deployment - offline CVE / threat-intel cache | +15% |
| 24×7 SLA support - dedicated CSM, 99.9% | +18% |
| White-label / MSSP - multi-tenant, OEM, revenue-share | Custom |
| Onboarding + migration - import from your current tools | Quoted |
Platform includes 5 dynamic-testing targets; Enterprise includes 10 with Agentic Pentest on each, plus air-gapped and 24×7 SLA. Further targets bill at the band rate. On lower tiers they are optional add-ons. Every compliance framework and every report (audit PDF, SOC 2 / ISO / PCI / NIST / HIPAA / GDPR mapping) is included on all three editions - compliance is not an upsell here. The tamper-evident Evidence Vault and auditor portals are the Enterprise addition; only white-label branding is paid.
Need dynamic testing on Essentials? Add target URLs at $900/URL/yr - or move to Platform, which includes five (cheaper past ~4 URLs for a 10-developer team).
Everything above is the platform. A human-led engagement is bought separately, needs no licence, and is quoted per engagement after a scoping call - from $4,900 focused, from $8,900 standard. It is only invoiced if it closes with a High or Critical finding; you keep the reports, the evidence and the free 90-day retest either way.
Developer count is something you already know and can verify against source control. Per-scan or per-finding pricing punishes the two things a security tool should encourage - scanning and finding more. DAST and Agentic Pentest, which scale with external surface rather than team size, are metered separately by target URL.
A distinct human with platform access, or a distinct code committer seen in the last 90 days - whichever is higher. CI service accounts, bots and inactive contributors do not count. A 2-developer team with 100 repositories pays for 2 developers, not 100 repositories.
Because it cannot run on its own. Agentic Pentest is a phase inside the dynamic-testing pipeline: the crawl and active scan build a map of the application, and the AI reasons over that map to generate and then prove application-specific hypotheses. Without the crawl there is nothing for it to reason about. So dynamic testing is $900 per target URL per year, and Agentic Pentest is an uplift of $600 on a target you are already testing. A URL is one registered scan target - a base host or application - not every crawled page. Platform includes five target URLs, Enterprise includes ten with the Agentic Pentest uplift on all of them, and further targets bill at the band rate. We do not offer an unlimited allowance: dynamic testing drives a real crawl, a real active scan and a real model, so an unbounded number of targets would be an unbounded cost that somebody ends up paying for.
A single one-off engagement: one target, dynamic testing plus Agentic Pentest, a full report, $900, no subscription and no platform commitment. Findings and evidence are yours to keep whether or not you go further. Most teams use this before deciding on an edition.
No free or metered tier. apPosture is licensed, and you choose where it runs: self-hosted, your own cloud account, or a dedicated instance we operate. Every option starts with the same 30-day proof of concept.
$2,000 (Essentials), $4,000 (Platform) or $7,500 (Enterprise) per year. The floor covers the on-prem support and onboarding every deployment needs; small teams bill at the floor until seat count grows past it.
The per-developer rate is shown monthly but billed annually, paid upfront. Multi-year commitments and 100+ seats earn a 15-25% discount. A perpetual licence plus maintenance is available for government buyers.
No. Inference runs on a local model inside your own boundary by default, or against your own provider key if you prefer a cloud model. There is no credit balance to top up and nothing to buy again mid-year, so what the AI costs you does not rise with how much you use it.
Yes, as a separate fixed-fee engagement that needs no platform licence - from $4,900 for a focused scope and from $8,900 for a standard one, quoted after a scoping call. It is only invoiced if it closes with a confirmed in-scope finding rated High or Critical (CVSS v3.1 ≥ 7.0); with nothing at that level you pay nothing and still keep the full report set, the signed attestation letter and the free 90-day retest. Every engagement includes an Agentic Pentest baseline pass over the same scope so the human days go on business logic rather than on what the engine already covers.
Then you do not pay for it. "Confirmed" here means a recorded, reproducible exploit in the evidence trail - the platform only marks a finding confirmed on real evidence, so this is a database fact you can audit rather than an opinion in a report.
Yes. The figures on this page are the list for our local market. We publish a separate list for the EU and GCC, where cost of delivery and support differ, and we invoice in local currency. Ask for the list that applies to you rather than converting these numbers.
Tell us your developer count, edition and whether you need air-gap - you get an exact price and a 30-day PoC in your own environment.