Plans & pricing
Go continuous, or pay per test.
AI pentesting you run on demand or wire into your CI/CD: subscribe for continuous coverage with unlimited retests, or run a one-off assessment when you need a point-in-time report. Every plan covers all application types and every compliance framework, with no per-vulnerability surcharges. Pick a plan and you get a flat, scoped quote within one working day.
- 1 application
- 12 full AI pentests / year (monthly)
- Unlimited retests
- 17 vulnerability categories
- PDF technical report
- Email support
- Extra full scans on request
- Everything in Starter, plus:
- Up to 5 applications
- 24 full pentests / year (pooled)
- CI/CD and API integration
- Branded reports and executive summary
- Signed attestation letter
- Priority support
- Everything in Growth, plus:
- Senior Penetration Tester review
- Application portfolio
- CI/CD-metered continuous scanning (volume rate)
- SLA guarantees
- Dedicated account manager
- On-premise deployment
Flat, scoped pricing: per test or per year, quoted within one working day. All prices exclude VAT.
How pricing works
How pricing works
Flat per plan
Every plan has a fixed, scoped price. Per-test plans are billed once per assessment; subscriptions are billed annually and include the scans and unlimited retests listed above.
Nothing per finding
No per-vulnerability surcharges and no add-ons for application type or compliance mapping. Extra full scans beyond a subscription allowance are quoted at a flat rate.
A quote in one working day
Tell us the plan and the application. You get a written quote within one working day, with no obligation.
Feature comparison
What each plan includes.
Testing capability is identical whether you subscribe or buy per-test — the same engine, categories, and compliance mapping across every plan. This table compares all five: the three subscriptions and the two per-test tiers.
| Feature | Starter | Growth | Scale | Professional | Enterprise |
|---|---|---|---|---|---|
| Applications covered | 1 | Up to 5 | Portfolio | Per test | Unlimited |
| CI/CD & API integration | - | Yes | Yes | - | Yes |
| Retests | Unlimited | Unlimited | Unlimited | 1 included | Unlimited |
| Burp Suite integration | - | Yes | Yes | Yes | Yes |
| Branded report + exec summary | - | Yes | Yes | Yes | Yes |
| Signed attestation letter | - | Yes | Yes | Yes | Yes |
| Senior pentester review | - | - | Yes | - | Yes |
| SLA guarantees | - | - | Yes | - | Yes |
| Dedicated account manager | - | - | Yes | - | Yes |
| On-premise deployment | - | - | Yes | - | Yes |
| Support | Priority | Dedicated | Priority | Dedicated |
Need expert-led testing?
Beyond the software tiers, our founding partner BeDefended offers a fully managed pentest: senior pentesters running manual testing in parallel with RedPick’s AI engine. Compliance-mapped reports (PCI DSS, SOC 2, NIS2, DORA, ISO 27001, GDPR, OWASP ASVS), a free retest after remediation, and an executive debrief session. Custom-scoped and quoted.
Buying through a partner?
RedPick is also sold and delivered by security partners and resellers, often bundled with their own scoping, remediation support and managed services. If you already work with one, ask them for RedPick. If you would like to resell or bundle RedPick yourself, tell us about your practice.
FAQ
Common questions.
Why aren't prices listed?
RedPick is sold directly and through partners and resellers in several markets, so the price you pay depends on the market and on how the service is bundled with partner services. Every plan still has a flat, scoped price: tell us which plan you want and you get a written quote within one working day.
Per-test or subscription — which should I choose?
Per-test is a one-off, point-in-time assessment with a full report — ideal for a compliance deadline or a specific release. A subscription gives continuous coverage: recurring AI pentests on your registered applications plus unlimited retests, so you re-verify fixes and catch regressions between releases without re-scoping each time.
What counts as a scan versus a retest?
A full scan is a complete new assessment of an application. A retest re-verifies a specific finding we already reported, after you have fixed it — unlimited under fair use, and not an open re-scan of the app. Full scans are included up to each plan's monthly allowance; additional scans are available on request.
Is there human review, or is it fully automated?
Fully automated by default. The standard per-test and subscription tiers run autonomously — trigger them on demand or straight from your CI/CD and get results with no human in the loop. Senior penetration-tester review is reserved for Enterprise and custom plans, and the managed engagement adds manual testing in parallel with the AI engine.
Does RedPick support compliance frameworks?
Yes. Findings are mapped to PCI DSS v4.0.1, SOC 2, ISO 27001, NIS2, DORA, GDPR, and OWASP ASVS, with audit-ready evidence and, on the higher tiers, a signed attestation letter.