You pay for your team - one developer, one price. Dynamic testing and AI Pentest, which scale with your external surface, are metered by target URL. Self-hosted, air-gapped-capable, annual. No free tier; a full 30-day proof-of-concept in your own environment.
Every edition is priced per developer / month, billed annually. Pick by the coverage you need; DAST and AI Pentest scale separately by target URL (below).
| Essentials | Platform | Enterprise | |
|---|---|---|---|
| Price | $35 / dev · mo | $70 / dev · mo | $90 / dev · mo |
| Best for | Code-security teams shifting left | A full AppSec program on one platform | Regulated, air-gapped, proof-of-exploit |
| Coverage | SAST · SCA · Secrets · IaC · Container | + DAST · Cloud posture · ASPM · API | + AI Pentest · Threat Modeling |
| DAST | Add-on / URL | Unlimited | Unlimited |
| AI Pentest | Add-on / URL | Add-on / URL | Unlimited |
| Compliance | OWASP Top 10 | + PCI · ISO 27001 · SOC 2 | + NIST · HIPAA · GDPR + evidence vault |
| Air-gapped | Optional (+15%) | Optional (+15%) | Included |
| Support | Community | 8×5 priority | 24×7 + SLA + CSM |
Prices are illustrative list (local market, on-prem annual licence). Minimum $3,000 / $5,000 / $9,000 per year by edition. For a written quote, contact us.
The platform is priced per developer - the bill tracks your team, not how many repositories or findings you have. Dynamic testing scales by the surface it reaches, so DAST and AI Pentest meter by target URL.
DAST is unlimited on Platform; AI Pentest is unlimited on Enterprise. Below those tiers each is an add-on per target URL - one registered scan target (a base host or application), not every crawled page.
Why per developer? A 2-developer team with 100 repositories pays for 2 developers - the bill tracks your team, and you can verify it against your source control.
All three are per developer / month, billed annually (local-market list). Subject to the per-edition minimum.
DAST is unlimited on Platform; AI Pentest is unlimited on Enterprise. Where they are add-ons, they bill per registered target URL with volume bands.
| Target URLs | Per URL · yr | vs list |
|---|---|---|
| 1 - 10 URLs | $1,200 | list |
| 11 - 25 | $950 | ≈ 20% off |
| 26 - 50 | $750 | ≈ 37% off |
| 51+ | Custom | talk to us |
AI Pentest add-on: $1,000 / URL · yr continuous, or $1,500 for a one-off assessment. Developers bill at a flat per-seat rate; 100+ seats and multi-year terms earn 15-25% off. Minimum $3,000 / $5,000 / $9,000 / year by edition.
Grounded in what the platform does today - not a roadmap.
| Capability | Essentials | Platform | Enterprise |
|---|---|---|---|
| SAST · SCA · Secrets · IaC · Container | ✓ | ✓ | ✓ |
| AI assistant + verified fix PRs | ✓ | ✓ | ✓ |
| DAST - proof-of-exploit dynamic testing | add-on | ✓ unlimited | ✓ unlimited |
| API security - OWASP API Top 10 | - | ✓ | ✓ |
| Cloud posture (CSPM) | - | ✓ | ✓ |
| ASPM correlation + attack-chain graph | - | ✓ | ✓ |
| Risk-weighted posture (0-100, A-F, trend) | partial | ✓ | ✓ |
| AI Pentest - agentic, proven exploitation | add-on | add-on | ✓ unlimited |
| Evidence-based threat modeling (STRIDE) | - | - | ✓ |
| CI/CD gate | Monitor | Block + PR | Fail-closed |
| SSO (OIDC / SAML / LDAP) + SCIM | - | ✓ | ✓ |
| RBAC + multi-tenant | - | partial | ✓ |
| Compliance frameworks | OWASP | PCI · ISO · SOC 2 | + NIST · HIPAA · GDPR |
| Tamper-evident evidence vault + auditor portals | - | partial | ✓ |
| Air-gapped deployment | +15% | +15% | Included |
| Support | Community | 8×5 priority | 24×7 + SLA |
| DAST - proof-of-exploit dynamic testing, per target URL (included unlimited on Platform+) | $1,200 / URL · yr |
| AI Pentest - agentic proven exploitation, per target URL (included unlimited on Enterprise) | $1,000 / URL · yr · or $1,500 one-off |
| Air-gapped deployment - offline CVE / threat-intel cache | +15% |
| 24×7 SLA support - dedicated CSM, 99.9% | +18% |
| White-label / MSSP - multi-tenant, OEM, revenue-share | Custom |
| Onboarding + migration - import from your current tools | Quoted |
DAST is included unlimited on Platform; AI Pentest, air-gapped and 24×7 SLA are included on Enterprise. On lower tiers they are optional add-ons. All reports (audit PDF, SOC 2 / ISO / PCI mapping, evidence vault) are included - only white-label branding is paid.
Need DAST on Essentials? Add target URLs at $1,200/URL/yr - or move to Platform, where DAST is unlimited (cheaper past ~3 URLs for a 10-developer team).
Developer count is something you already know and can verify against your source control. Per-scan or per-finding pricing punishes you for the two things a security tool should encourage - scanning more often and finding more. Dynamic testing and AI Pentest, the parts that scale with external surface rather than team size, are metered separately by target URL.
A distinct human with platform access, or a distinct code committer seen in the last 90 days - whichever is higher. CI service accounts, bots and inactive or archived contributors do not count. A 2-developer team with 100 repositories pays for 2 developers, not 100 repositories.
Platform includes unlimited DAST; Enterprise includes unlimited AI Pentest. Below those tiers each is an add-on priced per target URL - $1,200/URL/yr for DAST, $1,000/URL/yr for AI Pentest (or $1,500 for a one-off assessment). A URL means one registered scan target - a base host or application - not every page the crawler visits.
No. apPosture is a self-hosted, licensed platform - there is no free or metered SaaS tier. Instead you get a full 30-day proof-of-concept in your own environment before you commit.
Yes - $3,000 (Essentials), $5,000 (Platform) or $9,000 (Enterprise) per year. The floor covers the on-prem support and onboarding every deployment needs; small teams bill at the floor until seat count grows past it.
The per-developer rate is shown per month but billed annually and paid upfront. Multi-year commitments and 100+ seats earn a 15-25% discount. A perpetual licence plus maintenance is available for government buyers.
These are illustrative list prices for the local market. Regional pricing and local-currency invoicing are available - contact us for a written quote for your scope.
Tell us your developer count, edition and whether you need air-gap - you get an exact price and a 30-day PoC in your own environment.