Simple, Transparent Pricing

Start free. Your attack surface changes every week. Pro and Enterprise keep pace with continuous monitoring, AI-guided hardening, and automatic reproof after every config change.

Platform

Attack Surface Dashboard

Passive recon, OPI scoring, and hardening guidance. No agent required.

Free

One domain, instant results

$0 forever
  • 1 root domain
  • Passive subdomain discovery
  • CDN / WAF detection
  • OPI score + risk summary
  • Basic hardening recommendations
  • Full subdomain enumeration
  • DDoS simulation
Get Started Free

Pro

Multi-domain coverage + full detail

$40 / month
  • Up to 5 root domains
  • Full subdomain discovery (500+ per domain)
  • Origin IP exposure check
  • All CDN / WAF / appliance vendors
  • Detailed OPI breakdown per asset
  • Vendor-specific hardening playbook
  • AI Hardening Copilot with guided fix steps
  • Email alerts on topology changes
  • 3 simulation credits / month (smoke-level runs)
Start Pro

Enterprise

Unlimited domains + team access

$200 / month
  • Unlimited root domains
  • Everything in Pro
  • API access
  • White-label PDF reports
  • Team seats (up to 25)
  • Priority support (email + call)
  • AI Hardening Copilot + vendor API reproof on config change
  • 25 simulation credits / month (up to 5 high-intensity runs)
Contact Sales

DDoS Simulation

per-engagement

from $25K / engagement
  • Scoped from your scan results
  • 101 attack vectors, 24 cloud platforms
  • Signed Statement of Work required

Estimate your scope

Or talk to us and we scope directly from your scan.

Continuous posture

Why the subscription stays valuable after the initial hardening

DDoS resilience isn't a one-time checklist. Five forces keep reopening gaps, without you doing anything.

Attack surface drift

DevOps ships a new subdomain. Marketing adds a third-party integration. Infra migrates a CDN region. Each change is a potential new exposure. Last month's scan doesn't know about this week's deploy.

New attack vectors every quarter

HTTP/3 QUIC floods, HollowByte TLS exhaustion, HTTP/2 Rapid Reset: none existed before 2023. January hardening doesn't cover October vectors. DDactic tracks 160+ classified vectors and updates continuously.

Vendor config changes undo hardening silently

Your WAF rate limit was correctly set in March. A routine rule update in July reset it. The Enterprise vendor API reproof catches this automatically, with no scheduling or manual re-engagement required.

Compliance needs a history, not a certificate

DORA TLPT, NIS2 Art. 21, SOC 2 A1.3, ISO 27001: all require periodic testing evidence. A one-time engagement report goes stale. Your OPI timeline is the audit trail that doesn't.

Hardening closes loops, not cases

Apply a fix. Earn a bonus credit. Re-run the test and watch the OPI score move. That verify loop turns a point-in-time audit into a continuous improvement program, and tells you when a fix actually held under load.

Compare Plans

All plans include the DDactic dashboard. Pro and Enterprise unlock full discovery depth.

Feature Free Pro Enterprise
Price $0 $40/mo $200/mo
Root domains 1 5 Unlimited
Subdomain discovery Passive only Full (500+ per domain) Full (500+ per domain)
CDN / WAF / Appliance detection 6 providers All providers All providers
Origin IP exposure Basic Deep scan Deep scan
OPI score Yes Full breakdown Full breakdown
Hardening playbook 3 recommendations Full vendor-specific Full vendor-specific
AI Hardening Copilot - Guided fix steps Guided fix + bonus credit loop
Vendor API reproof - - Auto-reproof on config change
Topology change alerts - Email Email + webhook
API access - - Yes
White-label PDF reports - - Yes
Team seats 1 3 25
Support Community Email Priority (email + call)
Simulation credits / month - 3 cr (3 smoke tests) 25 cr (up to 5 high-intensity)
Get Started Start Pro Contact Sales

DDoS Simulation

Live botnet testing from 24 cloud platforms against your verified infrastructure. Priced by engagement scope: endpoints under test, attack vectors selected, target intensity (Gbps), and test duration. A single domain with 500 subdomains costs more to test than five simple domains. Contact us and we scope it directly from your scan results. Requires a signed Statement of Work and domain ownership verification before any traffic runs.

⚡

101 Attack Vectors

HTTP/2 Rapid Reset, HTTP/3 QUIC, WAF bypass, volumetric, slowloris, and more

🌐

24 Cloud Platforms

Distributed load from AWS, GCP, Azure, Hetzner, Vultr, OVH, and 18 others

📊

Closed-loop Hardening

Vendor-specific CLI commands verified by re-test after each fix

🛡

Full Kill Switch

Stop any test instantly. No traffic to production without your explicit sign-off.

Request a Quote
Early access

How simulation credits work

Credits are the unit for automated simulation runs. Your monthly plan includes a credit allowance. Different run intensities cost different credits, so the allowance maps to a precise number of runs you can actually run.

Run type Credits Bots Duration What it tests Pro (3 cr) Enterprise (25 cr)
Smoke 1 cr 25 5 min Baseline response under light load 3 runs 25 runs
Sustained 2 cr 75 10 min Mid-tier amplification + L7 mix 1 run 12 runs
High-intensity 5 cr 200 15 min Peak adversarial across all vectors N/A 5 runs

Pro's 3 credits cover smoke-level runs. High-intensity (5 cr) requires Enterprise or an add-on pack.

1

Credits reset monthly, bonus credits roll over

Your base monthly allowance resets on your billing date. Use it or lose it. Bonus credits earned by applying hardening recommendations (up to 5/month) roll over for up to 3 months.

2

Hardening earns bonus credits

Apply and verify a recommendation from your hardening playbook and earn +1 credit toward your next run. Acting on the findings pays toward proving they worked.

3

Production engagements go beyond credits

Full-fleet, multi-hour, multi-vector engagements are scoped from your verified attack surface and priced separately. Credits don't limit what an SOW engagement can do.

All simulation requires domain ownership verification before any traffic runs. Runs go through your CDN or WAF layer. No traffic reaches your origin without explicit sign-off. Credits are in early access; allowances are not a binding offer yet. Contact us for production-scale terms.

Founding Design Partner Program

5 seats. No deadline.

For the first 5 customers who help shape the product. Graduated pricing across years 1-3 so renewal is predictable, not a cliff.

Year 1: Founding Partner

Locked across four quarterly cycles

90% off standard tier rate
  • Full Test Plan tailored to your stack
  • Live botnet test from 24 cloud platforms
  • Hardening Playbook with vendor-specific commands
  • Three quarterly reruns over 12 months
  • Direct line to the founder
  • Quarterly feedback session, anonymized inclusion in research
Apply for FDP

Year 2: Design Partner Graduate

Permanent benefit for FDP graduates

50% off standard tier rate
  • Same scope and deliverables as year 1
  • Locked across all four quarterly cycles in year 2
  • Smooths the year-1-to-standard transition
  • Written into the SOW from day one

Year 3+: Standard or Renegotiated

Based on year-2 outcomes and scope

Standard tier rate
  • Standard Enterprise tier rate, or renegotiated based on scope changes
  • Stackable with multi-year prepay (10% off 2-year, 15% off 3-year)
  • Stackable with annual prepay (10% off vs quarterly)

Customers 6-50 enter under Founder's Pricing (40% off year 1). Contact us to check availability.

Frequently Asked Questions

What counts as a "root domain"?
A root domain is a registrable domain (e.g. example.com, example.co.uk). Subdomains of that root (api.example.com, cdn.example.com) are all included under the same root domain slot. The Free plan covers 1 root domain; Pro covers up to 5; Enterprise is unlimited.
What is the difference between the platform and DDoS simulation?
The platform (Free/Pro/Enterprise) is passive: it discovers your attack surface, scores your defenses with OPI, and generates hardening recommendations, with no traffic sent to your infrastructure. DDoS simulation is an active engagement that fires real distributed load from our bot fleet against your verified assets. Simulation is priced separately and requires a signed Statement of Work.
How does DDoS simulation pricing work?
Cost is driven by endpoints under test, the attack vectors you run, target intensity (Gbps), and reruns, not domain count. A client with one domain and 500 subdomains costs more to test than one with five simple domains. Contact us and we scope it directly from your scan results. No surprises.
Is DDoS testing safe for production?
Yes. We require domain ownership verification before any active test begins. All simulations run through your CDN or WAF layer. No traffic reaches your origin without your explicit sign-off. Full kill switches are wired to stop any test within seconds.
My team finished the initial hardening. Why stay subscribed?
Because your attack surface didn't stop changing. New subdomains get added by DevOps, CDN configs get updated, new DDoS attack vectors emerge every quarter, and vendor rules reset silently. The hardening you completed in January may not cover what's exposed in October. The subscription keeps your OPI score current, alerts you when topology changes open new gaps, and reproves your vendor configs automatically in Enterprise. If you only need a one-time snapshot, the Free tier is fine, but most teams find their first drift alert within 30 days.
Can I cancel anytime?
Pro and Enterprise platform subscriptions are month-to-month; cancel anytime. DDoS simulation engagements are annual contracts with a scope defined in the SOW, but include a kill-switch clause if testing needs to halt.
Do you offer a money-back guarantee?
For DDoS simulation: if our assessment finds no actionable findings, we refund 100% of your payment. We are confident in our methodology.

Start with a Free Scan

See your OPI score in minutes. No credit card, no agent install required.

Get Started Free Talk to Sales