No day rates, no per-seat maths, no plans to compare. Every run tells you how many findings there are and how serious, at no cost. You pay when you want to know what they are, where they sit and how to close them.
There is one product: a full external test of one application and its APIs. What it costs does not depend on a plan, a seat count or a contract term.
One application and its APIs, tested end to end. No card to start, no subscription, no minimum term.
Run a testNothing critical or high proven — no invoice.
Three moments. Two of them cost nothing, and the third only happens if the run found something worth the money.
Add a domain, prove it is yours with one DNS record, start the run. When it ends you see how many findings there are and how serious — by severity, as a count.
No card, no commitment
Titles, locations, proof and fixes stay closed until you unlock them. You decide with the count already in front of you, so you are never paying to find out whether it was worth paying.
Only if something critical or high was proven
Mark what you fixed, push it, and run the test again against those findings. One re-test, within fourteen days, at no cost — however many findings it covers. A fix you cannot verify is not a fix.
Once per paid run
A traditional pentest is still the right call for hardware, mobile and highly contextual targets. For a web application and its APIs, this is what changes.
| Plaris1 | Traditional pentest | |
|---|---|---|
| Time to first result | A few hours | 4–6 weeks after scheduling |
| Price for one web app | €199 per test | $8,000–$20,000 |
| Re-test after your fix | One free re-test, within 14 days | Billed as a new engagement |
| How often you can run it | Up to five runs a day, one at a time | Once a year, in practice |
| False positives | Dropped unless re-exploited | Rare, but so is coverage between audits |
| Audit-ready report | SOC 2 and ISO 27001 formats | Yes |
| If nothing serious is found | No invoice | Full fee |
Every run ends with a count: how many findings, at which severity. That part is free, needs no card, and is enough to know whether you have a problem. What costs €199 is the findings themselves — the titles, where they sit, the proof that each one is real, and the change that closes it. You decide with the count already in front of you, so you never pay to find out whether paying was worth it.
Then the run is free. We only charge when at least one critical or high finding is proven — reproduced twice, with different parameters, by a second agent. Medium and low findings are shown either way, at no cost, and you keep all four reports. A clean run is a result you can show a customer, not an empty invoice.
It is one re-test, not one per finding: mark everything you fixed, start it once, and it checks all of them together. It belongs to a paid run — it verifies that you fixed what you paid to see. If nothing critical or high was proven, the run cost nothing and there is nothing to re-test; start a new run whenever you ship something that changes the picture.
A score of 70 or above on our 1–100 scale, which multiplies four factors: how far the attack reaches, how sensitive the data is, how reliably it reproduces, and who can trigger it. Reachable customer data is the heaviest case — but takeover-able accounts, bypassable permissions and executable code count the same. The score is computed, not assigned by hand, and the severity label follows from it.
No. By default everything is tested from outside, exactly like a stranger would. Connecting a repository or an OpenAPI spec makes coverage deeper, because the agents then understand your roles and data flows — but it is optional, and access is read-only.
Testing is external and non-destructive, rate-limited, and preceded by pre-flight checks. Agents stop at the first proof instead of digging deeper, and one button kills every agent instantly. You can also point a run at staging.
You list which domains may be attacked and which are only in scope for observation. When a finding could be chained into something worse, the run pauses and shows you the analysis — it only escalates if you press the button.
A scanner reports what looks wrong. Here, a second agent has to reproduce the attack before the finding is written up at all — and if it cannot, the finding is dropped. That is the difference between 1,428 lines and six.
Yes. The full report contains every finding with technical detail, proof of exploit and remediation guidance, structured for SOC 2 and ISO 27001. There is also a customer-facing version that proves your posture without exposing your stack.
If a paid test produces nothing rated high or critical, we do not invoice it. You still get the written clean bill you can send to a prospect. It applies to every per-test run.
Most finish within a few hours, and the report is available the same day. You can watch the agents work live rather than waiting for an email.
Always. One DNS TXT record, checked before the first run and re-checked before every later one. Remove the record and testing stops.
Starting a run needs no card and no call. And if nothing critical or high is proven, the test costs nothing either.