Security assessment and ASM costs
Security spend is counted two different ways: a one-off assessment you commission, and continuous monitoring you subscribe to. This page puts both cost bands on one screen and explains what each price actually buys you.
Landscape
Service types and rough cost
| Type | Price band |
|---|---|
| Free single-scan (Vendor F)Scans one site for free or a low fee. No asset discovery or continuous monitoring. | Free–~$2/mo (no discovery, single site) |
| Commissioned assessment, tool-ledA one-off assessment driven by automated scanning. No asset discovery or continuous monitoring. | from ~$2,000 per assessment (published guide price) |
| Commissioned assessment, expert-manualSpecialists work through the target by hand. Scope and depth move the price a lot. | from ~$6,800 per assessment (published guide price) |
| Self-serve tool (Vendor A)You operate the tool yourself to scan and monitor. Operations are on you. | Self-serve from ~$270/mo / assisted from ~$800/mo (human) |
| Per-domain (Vendor B)Attack-surface management (ASM) contracted and billed per domain. | ~$300/mo per domain |
| Continuous human analyst (Vendor C)Analysts scan and report on an ongoing basis. Hands-on, but expensive. | from ~$2,000/mo |
| AI scan (Vendor D)AI scans apps and code and even proposes fixes (more app/code testing than external attack surface). | from ~$470/mo |
| Suite / inquiry-based (Vendor E)Bundles several capabilities. ASM pricing is inquiry-based. | ASM: inquiry / scan from ~$330/mo |
| Global low-cost SaaS (English-only)Self-serve SaaS with English-only UI and support. | $99 / $129 / €82–302 (monthly, 3 services) |
| Global majors (English, enterprise, annual)Global enterprise attack-surface tools. Enterprise-oriented, annual contracts, pricing on inquiry. | thousands of $/mo (undisclosed, annual, inquiry) |
| PentaTrailAI-native CTEM/ASM. Discovery through validation, remediation, and executive reporting — at this price. | ASM $290 / CTEM $490 (3 domains, 5 users; unlimited subdomains) |
Which type
Which type should you pick?
It comes down to your current setup and how much you want automated. Read the ones that apply.
Cost is the overriding concern
A free single-scan service is the candidate. It does no asset discovery and no continuous monitoring, so you will not see the whole attack surface. If you have one site and it rarely changes that is enough, but once assets multiply or appear without anyone telling you, PentaTrail ASM ($290/mo) is what covers the whole of it.
You want to run it yourself
A self-serve tool automates discovery and monitoring. If you have someone to operate it and you want to keep judgement calls in-house, this is the fit. If you would rather hand over validation and remediation tracking too, that is PentaTrail CTEM ($490/mo).
You want people alongside you
A continuous human analyst service runs roughly $800–$2,000/mo. If you want judgement shaped around your business, and someone to speak to it in a board meeting, that price has a reason behind it. If you want the same prioritisation, guidance and validation driven by AI, that is PentaTrail CTEM at $490/mo.
You need the coverage and track record of a global major
A global major is the candidate. Discovery and detection cover a wide surface and the service catalogue is broad. Expect an annual contract running into thousands of dollars per month, with an English-only UI and support. If you want discovery through validation, remediation and board reporting for $490/mo instead, that is PentaTrail CTEM.
You want discovery through to board reporting, handled by AI
PentaTrail fits. ASM ($290/mo) covers discovery, monitoring and risk ranking; CTEM ($490/mo) adds validation, remediation tracking and board reporting end to end.
Comparison
Feature & coverage comparison
| PentaTrail CTEM ($490) | PentaTrail ASM ($290) | Vendor F (free single-scan) | Vendor A (self-serve tool) | Vendor B (per-domain) | Vendor C (human analyst) | Vendor D (AI scan) | Vendor E (suite) | Global low-cost SaaS (English) | Global majors (English, enterprise) | |
|---|---|---|---|---|---|---|---|---|---|---|
| Automated asset discovery | ◎ | ◎ | ✕ | ◎ | ◎ | ◎ | — | ◎ | ◎ | ◎ |
| Continuous monitoring & diff | ◎ | ◎ | △ | ◎ | ○ | ○ | ○ | ◎ | ○ | ◎ |
| Detect & rank vulnerabilitiesOrder found issues from most to least dangerous | ◎ | ◎ | ○ | ◎ | ○ | ◎ | ○ | ◎ | ◎ | ◎ |
| Fix guidance & task bundling (AI)We bundle many findings by fix approach into a few clear tasks | ◎ | ◎ | ✕ | ✕ | — | — | ○ | △ | △ | △ |
| AI-native + MCPOperate it from an AI agent over MCP | ◎ | ◎ | ✕ | ✕ | — | — | ○ | ✕ | ✕ | △ |
| Evidence you can seeShows why it is risky, and it can be audited | ○ | ○ | △ | ○ | — | — | ○ | ○ | ○ | △ |
| Actually check if it is exploitable (validation) | ◎ | ✕ | ✕ | △ | — | ◎ | ◎ | ○ | △ | △ |
| Remediation task management (owner / due date) | ◎ | ✕ | ✕ | ✕ | — | — | — | △ | △ | ○ |
| Business-impact grouping & ownershipGroup by business impact and assign an owner | ◎ | ✕ | ✕ | △ | — | — | — | △ | △ | △ |
| Executive summary | ◎ | ✕ | ✕ | △ | — | — | — | △ | △ | ○ |
| Price (starting monthly) | $490 | $290 | Free–~$2 | from ~$270 | ~$300/domain | from ~$2,000 | from ~$470 | from ~$330 (ASM: inquiry) | $99 / $129 / €82–302 | thousands of $ (inquiry) |
| Pricing transparency (can you pin the total?) | ◎ | ◎ | ◎ | △ | ◎ | △ | △ | ✕ | △ | ✕ |
Based on each vendor's public information (as of August 2026). "✕" means a vendor does not officially advertise it; "—" means it could not be confirmed from public information (not necessarily unsupported). "Pricing transparency" marks a flat, pin-downable total as ◎ and a from-only figure as △. "Global majors" is a grouped column of several English, enterprise services with undisclosed (annual, inquiry-based) pricing. Competitor prices are approximate conversions of published prices (mostly JPY).
Last updated: 2026-08-07
Billing
Can you predict the bill?
The dividing line is whether you can predict your bill as your attack surface — the sites you monitor, hosts like shop.example.com — grows.
| Billing model | Predictability |
|---|---|
| PentaTrail (billed per domain) | Flat. You pay by the number of domains ($290 = 3 domains included, +$75 per additional domain). Every subdomain under a domain is included with no cap, so adding subdomains never changes the price. You can total it from the public prices alone. |
| Billed per asset (site) | The more sites you monitor, the higher the price. The total often requires a sales inquiry, and cost gets harder to predict as your attack surface grows. |
Why so affordable
Why we can offer it at this price
PentaTrail is $290 for ASM and $490 for CTEM not because of a discount, but because it's built differently.
Built end-to-end with AI
PentaTrail is designed from real security-operations experience and built end-to-end with generative AI. The developer salaries that are the biggest cost of traditional software barely apply here.
No human analyst in the loop
Discovery runs on deterministic techniques (DNS, certificate logs, OSINT); validation, remediation guidance, and executive reports are AI-generated. There is no continuous human-analyst cost — the kind behind services at thousands of dollars a month — baked into the price.
No sales gate
Pricing, features, and real sample reports are all public, so there is no quoting or sales-call overhead. We pass that saving back into the price.
Why PentaTrail
Finding isn't protecting.
From discovery to validation, remediation, and board-level reporting — done with AI. That's why we can publish pricing and features in full.
Pricing, features, and real sample reports — all visible on this page
Per-domain pricing. Monitor any number of subdomains; the wider your surface, the lower the cost
We don't stop at discovery — AI actually checks whether it's exploitable
Bundle many findings by fix approach into a few clear tasks. Manage by owner and due date, up to executive reporting
FAQ
Frequently Asked Questions
What do these services typically cost?
For external attack-surface management, self-serve tools start around $270/mo, per-domain billing around $300/mo, and continuous human-analyst services around $2,000/mo. PentaTrail is $290 for ASM and $490 for CTEM.
Should I choose ASM or CTEM?
If you want to find, monitor, and rank your attack surface by risk, ASM ($290/mo). If you also want AI to validate exploitability, drive remediation by owner and due date, and produce executive reports, CTEM ($490/mo). You can upgrade to CTEM later.
How is this different from a continuous human-analyst service?
Continuous human-analyst services run about $800–$2,000/mo. PentaTrail automates the same prioritization, remediation guidance, and validation with AI and delivers it at CTEM $490/mo.
Is a one-off assessment cheaper than continuous monitoring?
They are counted differently, so they do not compare directly. A commissioned assessment starts from about $2,000 per assessment when it is tool-led, and from about $6,800 per assessment when specialists work by hand. Continuous external attack-surface monitoring is monthly; PentaTrail is $290/mo for ASM and $490/mo for CTEM. An assessment inspects an agreed scope deeply, once. Continuous monitoring starts from the domains you register, widens automatically to assets externally related to them, and looks every day (unrelated domains still have to be added by hand). They confirm different things.