Three tiers. Pick the coverage you need.
Unlimited tests on every tier — run them as often as you like.
Web application pentesting
NewCore, Pro and Elite ask whether someone can break into your infrastructure, or move around once they are in. Web application pentesting tests whether someone can misuse the application itself.
Not included in the Core, Pro or Elite prices above.
These are the Essential Eight controls autonomous testing can prove. Other obligations — policy, logging, governance — need documentation, not a pentest.
See exactly which in the coverage map
AUD, per year. Pricing reviewed quarterly against USD reference rates.
Not ready for continuous? Start with a single test.
NodeZero Flex runs one full autonomous pentest — the same platform, the same proof, no recurring schedule. See what an attacker could reach, fix it, verify the fix, then decide whether to go continuous. Priced per test for your environment.
| Feature | Core | Pro | Elite |
|---|---|---|---|
| Autonomous pentesting | |||
| Internal pentests | |||
| External pentests | |||
| External asset discovery | |||
| Cloud pentests (Azure, AWS) | |||
| Kubernetes pentest | |||
| AD password audit | |||
| Phishing integration | |||
| Scheduled recurring tests | |||
| Threat Informed Perspectives (pentesting campaigns) | |||
| Operations | |||
| Vulnerability Management Hub | |||
| Fix actions with Quick Verify | |||
| Reports | |||
| MCP server | |||
| Endpoint (EDR) effectiveness | |||
| Threat detection | |||
| Tripwires threat detection | |||
| Rapid response N-day alerting | |||
| Risk-based vulnerability management | |||
| Vulnerability Risk Intelligence | |||
| High-Value Targeting | |||
| Threat Actor Intelligence | |||
| Advanced Data Pilfering | |||
| Insights — org-wide posture | |||
What counts as an asset?
NodeZero identifies unique assets by matching across IP address, host name, MAC address and cloud identifiers (such as AWS ARN).
The algorithm accounts for ephemeral IP addresses that occur via DHCP, Kubernetes containers, virtual machines and similar — so transient hosts don't inflate your count.
- Servers
- Laptops, desktops and mobile devices
- Virtual machines
- Printers
- IoT devices
- Switches, routers, access points, endpoints
- Public static IPs
- Lambdas and serverless architecture
- Kubernetes workloads
Common questions
Can we run a single test before committing to a tier?
How is an asset counted?
Is pricing billed annually?
What happens if I exceed my asset count?
How are the AUD prices set?
Where is my data stored?
How do I get a quote for more than 500 assets?
Ready to see NodeZero in action?
Book a demo with our team and we'll walk you through pricing options for your environment.
Book a demo