ZeroThreat

ZeroThreat is an AI-powered autonomous penetration-testing platform for web applications and APIs. It is designed to discover application assets, analyze authentication and business logic, simulate attacker workflows, validate whether issues are exploitable, and produce prioritized findings with remediation guidance.

What it does

ZeroThreat supports security testing across web applications and APIs, including REST, GraphQL, SOAP, and gRPC services. The vendor documents both unauthenticated and authenticated scans, login sequences, MFA applications, recorded browser pages and actions, custom headers, and internal APIs.

Its documented testing process covers discovery, context-aware analysis, controlled exploitation, proof-based reporting, and rescanning after code or configuration changes. Findings can include request and response evidence, payloads, exploit traces, impact details, and mappings to frameworks and standards such as OWASP, CWE/SANS, PCI DSS, HIPAA, ISO 27001, and GDPR.

Notable capabilities

• Web application and API asset and endpoint discovery
• Authenticated testing with login flows, MFA applications, and recorded browser actions
• Support for REST, GraphQL, SOAP, gRPC, and internal APIs
• Vulnerability retesting, scheduled scans, and continuous rescanning workflows
• Integrations with CI/CD, issue tracking, and collaboration tools, including GitHub Actions, GitLab CI/CD, Jira, Slack, and Microsoft Teams

Who it helps

ZeroThreat is aimed at development, application security, and security engineering teams that need recurring penetration testing for web applications or APIs. It may fit organizations that need evidence-backed findings for remediation or compliance work, particularly when applications change frequently and manual retesting is difficult to maintain.

It is also relevant to teams that need to test authenticated application behavior rather than only exposed, unauthenticated endpoints. Organizations evaluating repository or live-URL security for applications created with AI development tools may also consider ShipSafe, which checks documented application security patterns and can generate remediation prompts; ZeroThreat’s documented focus is autonomous penetration testing of running web applications and APIs.

How it fits a workflow

A team can configure a target, provide authentication or browser-flow details where needed, and run scans manually or on a schedule. Results are intended to support triage through prioritized risk information, exploit evidence, impact descriptions, and remediation guidance. The vendor also documents API discovery from code, vulnerability retesting, scan reports, and connections to CI/CD and issue-management systems for incorporating results into development workflows.

ZeroThreat documents cloud and on-premises deployment options, regional data controls, and configuration for generative-AI features. The vendor states that scans typically start within minutes and take about 30 minutes to two hours, depending on application size.

Strengths and limits

The documented strengths are its breadth across web and API protocols, support for authenticated workflows, proof-oriented findings, and repeat scanning after changes. Pricing and usage depend on targets or scan credits: the free plan includes one scan credit per month, one target per account, limited vulnerability-insight previews, and authenticated scanning. New accounts receive five promotional credits valid for 15 days. The Professional plan is listed at $100 per month for one target, with additional targets at $75 each; pay-per-scan pricing is listed as $125 for five credits, with individual credits priced at $25 and volume discounts of up to 20%.

These limits make target count, scan frequency, and application size important considerations when assessing fit. The published pricing and scan-time claims are vendor-provided and may change.