3 plans.
Pick how deep we go.

Same AI agents, same engineer review, same proven exploits. The plan decides how much of your product we reach, and how much of our engineers’ time you get.

Blackbox
From the outside, like an attacker.
$1,500
per month
  • Continuous testing of your public surface. No access, nothing to set up
  • Every finding verified by a security engineer before you see it
  • The exact request that worked, the data it exposed, reproduction steps, a recommended fix
  • An alert the moment we find something. A report every month

Best for: seeing exactly what an outsider sees.

Greybox
Outside and in.
$3,000
per month
  • Everything in Blackbox
  • Testing behind the login: test accounts, API keys, staging, whatever you share
  • Findings and recommendations prioritised for your product, not a generic list
  • 40 hours a month of a Greywatch engineer, working with your team to reproduce, prioritise and verify fixes

Best for: products where the risk lives behind the login.

Whitebox
Everything. Code, cloud, app.
$6,000
per month
  • Everything in Greybox
  • Source code, read-only. Cloud infrastructure. Application security
  • Root cause for every finding: the file and the line, not just the symptom at the edge
  • 80 hours a month of a Greywatch engineer

Best for: teams that want the most thorough answer we can give.

Move between plans whenever you like. Not sure which? Talk to us →

Not convinced?

Try us for 3 months. Pay only for results.

No monthly fee. You pay only if we find a Critical or High vulnerability. If we find none, you pay nothing.

The 3-month trial
Same testing, same engineer review, same proven findings. $0 a month; you pay per proven Critical or High. Rates and scope agreed on a call before we start.
Start a trial →
Need a different shape?
Multiple products, a bigger surface, a different mix of engineer hours. Tell us what you have and we will put a deal together.
Talk to us about a custom plan →
How severity is scored

Scored on CVSS, not on our word.

The trial raises a fair question: what stops us calling everything Critical? Severity is set by CVSS, the public industry standard. Every finding carries its score and the working exploit behind it, so you can check both yourself.

SeverityCVSS scoreOn a planOn the trial
Critical9.0 - 10.0IncludedBilled
High7.0 - 8.9IncludedBilled
Medium4.0 - 6.9IncludedFree
Low0.1 - 3.9IncludedFree
Questions

Before you choose.

Which plan should I start with?
Blackbox if you want to see what an outsider sees without sharing anything. Greybox if the risk in your product lives behind the login. Whitebox if you want the most thorough answer we can give. You can move between plans whenever you like.
What do the engineer hours cover?
A Greywatch engineer working with your team: reproducing findings on your side, prioritising what to fix first, and verifying fixes once they ship. Your team owns the code and the release. We never change it.
How does the 3-month trial work?
No monthly fee for 3 months. You pay only for proven Critical or High findings, and nothing if we find none. The rates, the scope and what happens after the trial are agreed on a call before we start.
What stops you rating everything Critical?
Severity is scored on CVSS, a public industry standard, not on our judgement. Every finding carries its CVSS score and the working exploit behind it, so you can check both yourself.
Is the testing different on the trial?
No. It is the same continuous testing, the same engineer review and the same proven findings. Only the way you pay is different.

Not sure how much access to share? See the engagement models →

Get started

Pick a plan, or let us find the right one.

Tell us what you want tested. A 20-minute call with a founder, and you leave with a plan and a start date.

✓ Thanks for reaching out. We'll be in touch shortly.