KEV-TICKERcves_ytd=28,720kev_total=1,289added_7d=+7[CISA KEV ↗]
// scanner: burp-suite-enterprise

Burp Suite Enterprise pricing 2026: $8,395 to $49,425 per year published

PortSwigger's enterprise DAST. Out-of-band Collaborator detection. Published list pricing.

author: Oliver Wakefield-Smith · verified 2026-06-26
// direct-answer

What does Burp Suite Enterprise cost in 2026?

$8,395-$49,425 / year published tiers. PortSwigger's enterprise DAST. Out-of-band Collaborator detection. Published list pricing.

Pricing snapshot

  • Starter$8,395 / year, 1 concurrent scan, 5 applications
  • Grow$17,380 / year, 5 concurrent scans, 50 applications
  • Accelerate$49,425 / year, 20 concurrent scans, unlimited applications
  • Burp Suite Professional (pen-tester)$475 / user / year
  • Burp AI add-onQuote-only on Grow / Accelerate

What scales, what does not

  • Collaborator-style out-of-band scanning surfaces blind XSS, SSRF, OOB SQLi that black-box scanners miss.
  • CI/CD plug-ins for Jenkins, GitLab, GitHub Actions ship in-product.
  • Pricing is one of the few in the segment that is fully transparent at list. Multi-year discounts are negotiated.

Where it hits the ceiling

Burp Enterprise's CLI-first scan triggering wins for engineering-led pipelines; Invicti wins for security-led PMs running scheduled scans.

// price-bandSIGNAL// verified 2026-06-26
// faq

FAQ

  • Is Burp Suite Enterprise pricing public?
    Yes. Burp Suite Enterprise publishes list pricing on its product page (cited above).
  • Is there a free tier of Burp Suite Enterprise?
    No formal free tier. Trials and PoCs are common.
  • Does Burp Suite Enterprise cover web application scanning?
    Yes, that is its primary product.
  • Does Burp Suite Enterprise produce PCI ASV evidence?
    Yes; Burp Suite Enterprise either is a PCI Approved Scanning Vendor or its output is regularly used as part of an ASV-attested package.
  • How often does Burp Suite Enterprise update its vulnerability content?
    Daily for commercial scanners (Tenable plugins, Qualys signatures, Rapid7 recog). Open-source OpenVAS NVT feed is daily but lags commercial coverage by hours to days.
Related: Pricing cheatsheet How we verify Directory