MapperPlus

Every service, on every plan.

One price covers the whole job: finding the asset, pentesting it, the report with proof, and the fix in your code. It scales with your attack surface, not with modules.

Prices in USD, per month, billed annually.

  • Starter

    One domain, tested around the clock.

    $990/ month

    $11,880 a year

    • 1 domain
    • Up to 25 live hosts
    • 2 repositories
    • 5 seats
    • Email support

  • Growth

    Most teams start here

    For a product with a few properties and a real engineering team.

    $2,490/ month

    $29,880 a year

    • 3 domains
    • Up to 100 live hosts
    • 10 repositories
    • Unlimited seats
    • Priority support
    • Onboarding call with your engineers

  • Scale

    For a wide attack surface and more than one team shipping to it.

    $5,900/ month

    $70,800 a year

    • 10 domains
    • Up to 500 live hosts
    • Unlimited repositories
    • Unlimited seats
    • Named contact
    • Help with your security questionnaires
    • Quarterly review of findings

  • Enterprise

    For many domains, many teams, and procurement.

    Talk to us

    Annual contract

    • Unlimited domains
    • Host count set with you
    • Unlimited repositories
    • Unlimited seats
    • MSA and DPA
    • Procurement and vendor review
    • Quarterly review with your team

Every plan starts the same way: we map your domain on the demo call and you see what is exposed before you buy.

Included

The whole product, from the first plan.

Plans set how much is tested, not what is tested. Starter runs the same discovery, the same pentests, and the same fixes as Enterprise.

  • Attack surface management with Cloudflare, Shodan, SecurityTrails, and VirusTotal
  • Exposure discovery: subdomains, open ports, and services as findings
  • Secret monitoring across your public JavaScript
  • Autonomous penetration testing on every reachable host, continuously
  • Business logic testing, proved on the live system
  • Findings reports with the requests that proved them, ready for your audit trail
  • Code fixed for you, opened as a merge request in GitHub, GitLab, or Bitbucket
  • Alerting to Jira, Linear, and PagerDuty
  • HackerOne and Bugcrowd report triage
  • SSO with SAML
  • ISO 27001 certified, encrypted in transit and at rest
  • Data deleted on request

How we count

Four numbers set the plan.

Domain
A root domain you add to the workspace, such as acme.com. Every subdomain under it is covered.
Live host
A host under your domains that answered at least once in the month. Hosts that go quiet stop counting.
Repository
A repository connected for fixes. Read-only until a merge request is opened.
Seat
A person who signs in to the workspace. Engineers who only review merge requests do not need one.

Beyond the plan

Grow without changing plan.

Extra domain
$300 a month, with its hosts counted toward your plan
Extra 50 live hosts
$300 a month
Monthly billing
Available on every plan at 20% more

Over 10 domains or 500 hosts, Enterprise is usually the cheaper path. Write to [email protected] and we will size it with you. ISO 27001 certificate and our security overview are available on request; see Trust.

Start with your domain.

Enter it below. We map what is exposed, walk you through it, and confirm the plan that fits.

ISO 27001 certifiedNothing to installYour team merges every fix