Best for Enterprise (19 options, 2026)

Burp Suite

freemium from $0/mo

Industry-standard pentest proxy — free Community for manual work, Pro $449/yr per user, Enterprise from $6,995/yr.

Detectify

paid from $89/mo

EASM + DAST hybrid — vulnerabilities sourced from a private researcher community, $89-$449/mo published tiers.

Acunetix

paid

Mature commercial DAST scanner from Invicti — quote-based, generally $4,500+/yr per target tier.

Invicti (formerly Netsparker)

paid

Enterprise DAST + IAST with Proof-Based Scanning — annual contracts, quote-only.

Veracode

paid

Enterprise AppSec platform — SAST + DAST + SCA + manual pentest. Public minimum ~$15,000/yr.

Checkmarx One

paid

Unified AppSec platform consolidating SAST/SCA/IAST/API/IaC. Quote-based, public minimums ~$30,000/yr.

Snyk

freemium from $0/mo

Developer-first SCA + SAST — Git/IDE/CI integration, generous free tier, paid Team from $25/dev/mo.

Astra Pentest

paid from $199/mo

Continuous DAST + manual pentest hybrid — published pricing $199-$5,999/yr, popular with SaaS startups.

Intruder.io

paid from $113/mo

Continuous external vulnerability scanner aimed at SMBs — published pricing from $113/mo per target group.

Probely

paid from $59/mo

API-first DAST scanner with developer ergonomics — published from $59/mo for a single target.

Rapid7 InsightAppSec

paid

Enterprise cloud DAST — quote-based, often bundled with InsightVM and InsightIDR.

Tenable Nessus

freemium from $0/mo

Industry-standard host/network vulnerability scanner — Essentials free for 16 IPs, Pro $3,590/yr.

Qualys VMDR

paid

Enterprise VM platform with web app scanning add-on — quote-based, asset-priced.

Wazuh

freemium from $0/mo

Open-source SIEM/XDR with file-integrity, vuln detection, compliance audit modules — also paid Wazuh Cloud.

HackerOne

paid

Largest bug bounty + VDP platform — quote-based, programs typically run $5K+/mo plus bounty pool.

Bugcrowd

paid

Crowdsourced security platform — bug bounty, pen-test-as-a-service, attack surface mgmt. Quote-based.

Cobalt

paid

Pentest-as-a-Service — vetted human testers, fixed-scope packages. Quote-based, typical engagement ~$8,000+.

ImmuniWeb

freemium from $0/mo

DAST + dark-web monitoring + compliance reporting — free public tests, paid quote-based platform.

Bright Security

paid

Developer-first DAST + API security with low false-positive claim — quote-based, formerly NeuraLegion.