// pricing
Vulnerability scanner pricing cheatsheet: per-asset, per-IP, per-app ceilings
Normalised list pricing per asset, per IP, per app, per cloud account across the 15-scanner directory. Quote-only vendors carry partner-reported ranges.
author: Oliver Wakefield-Smith · verified 2026-06-26
// direct-answer
How much does a vulnerability scanner cost in 2026?
Published per-asset network VM runs ~$7-$35/asset/yr (ManageEngine low, Tenable.io high); Qualys and Rapid7 are quote-only, partner-reported ~$21-$199/asset/yr. Web DAST is largely quote-only now (Invicti ~$5k/app partner-reported; Burp Suite DAST quote-only). Cloud-native CNAPP is quote-only, $50k-$120k mid-market. Snyk anchors per-developer at $25/dev/mo. OSS is free, loaded at admin hours.
| Scanner | Anchor unit | List rate | Public? |
|---|---|---|---|
| Tenable Nessus Professional | Nessus pricing 2026 | $4,790 / scanner / year (list) | PUBLIC |
| Tenable Vulnerability Management | Tenable.io pricing 2026 | ~$35 / asset / year (100-asset list anchor) | PUBLIC |
| Qualys VMDR | Qualys VMDR pricing 2026 | Quote only (partner-reported ~$199 / asset / yr) | QUOTE |
| Rapid7 InsightVM | Rapid7 InsightVM pricing 2026 | Quote only (Exposure Command); partner-reported ~$1.75/asset/mo (~$21/asset/yr) | QUOTE |
| Wiz | Wiz pricing 2026 | Quote only; per-workload anchor; $50k-$120k partner-reported mid-market | QUOTE |
| Orca Security | Orca Security pricing 2026 | Quote only; partner-reported $50k-$100k per ~500-workload estate | QUOTE |
| Snyk | Snyk pricing 2026 | Free up to caps; Team $25/dev/mo; Enterprise quote-only | PUBLIC |
| Invicti | Invicti pricing 2026 | Quote only (~$5,000 / app / yr partner-reported) | QUOTE |
| Acunetix | Acunetix pricing 2026 | Quote only; partner-reported $4,500-$7,000 Standard for 5 targets | QUOTE |
| Burp Suite Enterprise | Burp Suite Enterprise pricing 2026 | Quote only (now Burp Suite DAST); former $8,395-$49,425 tiers withdrawn | QUOTE |
| ManageEngine Vulnerability Manager Plus | ManageEngine VMP pricing 2026 | Professional $695 / year for 100 workstations | PUBLIC |
| HostedScan | HostedScan pricing 2026 | Basic $39/mo; Premium $109/mo; Professional $189/mo; Flex from $3,500/yr | PUBLIC |
| Pentest-Tools.com | Pentest-Tools.com pricing 2026 | NetSec $95/mo; WebNetSec $140/mo; Pentest Suite $190/mo (from 5 assets) | PUBLIC |
| OpenVAS / Greenbone Community Edition | OpenVAS pricing 2026 | Free (GPL). Loaded cost = admin hours + infra. | PUBLIC |
| Trivy | Trivy pricing 2026 | Free (Apache 2.0). CI/CD scan minutes are the marginal cost. | PUBLIC |
RFP discount window 2026
Across the 15 scanners on this directory, the realistic RFP discount window holds at 20-35% off list for committed multi-year contracts at meaningful asset counts (1,000+). Above 10,000 assets the floor drops further but is highly negotiation-dependent.
// faq
FAQ
- Why are some prices quote-only?Qualys, Rapid7, Wiz, Orca, Invicti, Acunetix, and Burp Suite Enterprise all decline to publish list pricing on their product pages as of 2026-07-27. Rapid7 folded InsightVM into Exposure Command and Burp Suite Enterprise became Burp Suite DAST, both dropping their former published rates. Partner-reported ranges in this table come from analyst write-ups and channel partners, not from the vendors themselves.
- What does the RFP discount window look like?20-35% off list for committed multi-year contracts at 1,000+ assets is the realistic 2026 floor. Larger estates negotiate further.
- How are modules priced on top?WAS, EASM, CTEM are almost always sold as add-on modules that uplift the headline number by 30-100% depending on the bundle.
- Is per-developer cheaper than per-asset?Only when developer count is materially lower than asset count. At 50 devs and 5k assets, per-developer wins; at 500 devs and 5k assets, per-asset wins.
- How often is this page re-verified?Monthly cadence; per-vendor pages carry the latest verified date as a row-level stamp.