Clear, transparent pricing trusted by 1000+ businesses
Offensive DAST vulnerability scanner that scans behind login for 15,000+ test cases like OWASP Top 10, ports, CVEs & more
$69/m
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
.svg)
$199/m
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$499/m
Target
You get 5 target slots, with the ability to change targets in those slots with a 30-day cooling period. Example: Scan 5 targets, after 30 days scan 5 new targets.
Target Explained: Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, website, API etc. If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$699/yr
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$1999/yr
Here's how the target is defined
Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, IP, website, API etc.
If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
$4999/yr
Target
You get 5 target slots, with the ability to change targets in those slots with a 30-day cooling period. Example: Scan 5 targets, after 30 days scan 5 new targets.
Target Explained: Simply put, a domain with all its site tree URLs is a target. Target can be the URL of a web application, website, API etc. If your website makes API calls to different domains (eg: api.example.com), you can add them as an extra host during setup without having to purchase another target for it, and all calls to api.examples.com from example.com will be scanned.
Hacker-style pentest by Autonomous AI & certified experts at dev speed, built to meet & exceed
SOC2, ISO, & HIPAA requirement
One web or SaaS app counts as one target, including all APIs consumed.
Mobile is per platform, so an Android app and an iOS app are two targets
Networks, cloud, IPs and standalone APIs are 1 target each
$2999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
One web or SaaS app counts as one target, including all APIs consumed.
Mobile is per platform, so an Android app and an iOS app are two targets
Networks, cloud, IPs and standalone APIs are 1 target each
$5999/yr
$9999/yr onwards
$999/yr
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Know More
Weekly vulnerability scans with 3000+ tests (OWASP, SANS etc.)
Essential features like pentest dashboard, PDF reports and scan behind login
Continuously discover & scan every API in your infrastructure for broken access control, authorization flaws, OWASP Top 10 & more
$199/m
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
$1999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
Astra continuously scans AWS, Azure, and GCP for misconfigs, IAM risks, and vulnerabilities, validating every finding before it reaches you
$99/m
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
$999/yr
$199/mo
If your website makes API calls to different domains, you can add them as an extra host without having to purchase another domain.
Let's say you have a customer dashboard at https://app.example.com/ and an admin dashboard at https://admin.example.com/ with different login pages, then you will need 2 targets.
Click the 🛈 icon to know more.
Loved by leading security conscious companies around the world
.avif)
.webp)
"Astra identified several moderate and high severity issues that our team never thought existed. We are working in the Mental Health space and data privacy and security are extremely critical to us. That being said, I am thankful for their service."
“A key standout during our Astra Pentest was the solid support via Slack, making communication easy and efficient. The platform itself is user-friendly, and the Jira integration greatly streamlined issue resolution for our team, seamlessly fitting into our existing workflow”
"Astra's exceptional manual penetration testing and efficient automated tools have provided invaluable insights into our application's security, making them our trusted partner for comprehensive and reliable security measures"
"Astra plugs straight into our agent tooling. Findings come with enough context that my coding agents fix, test, and validate the patch with a human in the loop. For a lean KYC platform, that's the difference between a backlog and a same-day fix."
"Astra's autonomous AI testing discovered two vulnerabilities that years of previous penetration tests had missed."
"The MCP integration is where Astra pulled ahead of every other pen test vendor we've engaged with. Our engineers pulled findings, repro steps, and fixes straight into their IDE. Triage turned into a few queries in chat. Fixes landed faster because the agent already had full context. Every finding came with detailed repro steps and a real fix. We'd hire them again."
Trusted by 1000+ engineering teams
.webp)
FAQs
Frequently asked questions
How do you define a target for DAST Scanner?
Do you offer discounts on multi-year commitments or bundled services?
Does Pentest (PTaaS) cover specific compliance requirements (e.g., SOC 2, PCI, ISO 27001)?
What is the timeline for manual and automated testing, including rescans?
How do you define a target for Pentest (PTaaS)?
- If you have a SaaS app, the entire app with all its APIs and underlying cloud is 1 target.
- If you have a mobile app, one Android app is considered as one target and one iOS app is considered another target. If they share code base, we offer a tailored pricing starting from $2200/app depending on the scope
- In case of networks, cloud, IPs and APIs - multiple clouds, IPs, APIs etc. can be clubbed into one target. Please schedule a call for tailored pricing.
What is covered in automated vs manual pentesting/VAPT?
How can I validate the fixed vulnerabilities?
Do you work with our developer in patching the vulnerabilities?
Find & fix every vulnerability with Astra
Astra's continuous pentest platform: PTaaS for expert led pentesting, DAST Scanner for continuous vulnerability detection & API Security Platform for API observability &
vulnerability scanning - all working together to secure your applications.
2 Million+
Vulnerabilities Uncovered
3,000+
Pentests Completed
4.6/5
on G2
