ZeroThreat

• The accuracy figure ZeroThreat leads with is its own and is inconsistent, at 99.9 percent on the site against the 98.9 percent an outside review records the company marketing, so a buyer who wants an outside read has to run the free tier and measure it.
• One aggregator records four employees at ZeroThreat as of May 2026, and no source in the reviewed record names a second person at the company, so a buyer cannot see who keeps the product running.
• ZeroThreat describes its platform as driven at its core by large language models such as GPT-4 Turbo and Gemini Ultra, and its payload library as compiled from public vulnerability data, so a buyer weighing what is proprietary here should ask which parts of the detection ZeroThreat builds itself.
• The one aggregator covering ZeroThreat's funding contradicts itself and no other reviewed source reports a raise, leaving a buyer no way to size how long the company can fund the roadmap it advertises.
• An outside review lists ZeroThreat as ISO certified and SOC 2 certified and no report or trust page appears on the probed surfaces, while the service takes target URLs, API specifications and authentication credentials, so a security-conscious buyer has to request the reports directly.
• Both named customer stories are the vendor's own accounts, and one testimonial in the whole record identifies its author's employer, so the reference base a buyer can check is two companies.

ZeroThreat sells against the cost of manual penetration testing. Its free-tool pages pitch the product as a way to save thousands on manual pen tests and tooling, and its paid plan prices continuous scanning at $100 a month for one application.

The pain is the company's own account of it. No source outside ZeroThreat in the reviewed record measures the gap it describes. Its CISO page frames the buyer as security leadership, offering a dashboard for monitoring dev and security team progress. An independent review names small and mid-sized teams buying at a fraction of enterprise pricing as the product's fit.

Price sets the segment more plainly than the positioning does. A free plan gives one scan credit a month against one target, the paid plan is $100 a month for one target application with further targets at $75, and scan credits sell at $25 each. [s2, s4, s7, s12]

The product tests a customer's web applications and APIs, discovers shadow endpoints, and executes real-world attack workflows against them. ZeroThreat's pages describe authenticated testing across SSO and multi-factor login, API coverage spanning REST, GraphQL and SOAP with checks for broken object and function level authorization, and Playwright rendering for modern single-page applications that the independent review lists among features still marked coming soon.

ZeroThreat picks the payloads itself and names the language models behind the analysis. Its engine page states that a KNN algorithm selects payloads from a library compiled out of public CVE databases, vulnerability disclosures and reported attack patterns, and its newsroom describes the platform as driven at its core by large language models such as GPT-4 Turbo and Gemini Ultra. Its payload library is therefore built from public sources, which is one part of the design a buyer can check.

Coverage is counted differently depending on the source. ZeroThreat's pricing page lists 130,000 vulnerabilities of coverage, its award submission counts 100,000 attack paths, and the independent review records more than 40,000 vulnerabilities. That reviewer also listed Playwright single-page-application scanning, agentic pentesting and Nuclei template support as marked coming soon and recorded on-premises deployment as proxy-only, and the agentic pentesting page carries a Coming Soon label. [s1, s2, s6, s12, s13, s15, s16]

ZeroThreat is placed in dynamic application security testing by the one independent review in the record, which sets it below the enterprise tools on price. That review names StackHawk as the developer-first alternative for teams that want scanning inside engineering pipelines, and names the free open-source scanner ZAP as the baseline against which any paid tool should be evaluated.

ZeroThreat leads on proof rather than detection. Its homepage argues that detection is easy and proof is hard, and offers reproducible proof of each exploit path as the thing a scanner does not deliver. That contrast is drawn by ZeroThreat against a category rather than against a named rival, and no cited source outside the company tests it.

An aggregator profile lists F5 Networks, A10 Networks and Traceable Security among its closest tracked competitors, which is a different peer set from the one the product review uses. Neither list is corroborated by analyst coverage in the reviewed record. [s1, s12, s14]

Two customers are named in the reviewed pages. Code House, an accounting and payroll software company in Australia, runs a payroll and debtors platform called Workforce One and adopted ZeroThreat for pre-release validation alongside penetration testing already part of its security program. OnPrintShop, a web-to-print software platform, integrated ZeroThreat into its release process to validate its security posture before releases.

The homepage labels the headline figure as organizations signed up. An October 2025 newsroom item restates the same number as organizations that trust the platform and, in the founder's words, as a 5,000-customer mark, without either page stating what any of them pays. No third party in the reviewed record reports a customer count, a revenue figure or a renewal rate.

The rest of the proof is testimonial. The customer stories page carries seven testimonials across six roles, three of them under full names, and names no employer beside any of them, while the Code House story identifies its own speaker as that company's managing director. Entry is self-serve, with a free tier, published list prices and a scan that starts without a credit card. [s1, s2, s5, s6, s8, s17]

One person is publicly attached to ZeroThreat. Co-founder Dharmesh Acharya is quoted in the company's own October 2025 newsroom item, and an aggregator profile records him as the company's founder.

No other person is identified as working for ZeroThreat. Its About Us page returns 404. No engineering leader, security researcher or advisory board appears in the reviewed sources, and the reviewed sources record no prior build, exit or publication for the founder.

How big ZeroThreat is depends on which entity a reader counts, and the record does not settle it. One aggregator puts ZeroThreat at four employees as of May 2026, the awards program's own entry records a company size of one to nine, and the same aggregator lists the company as associated with Radix Software Services Private Limited, an Indian software firm incorporated in 2010 that it records at 524 employees as of August 2025. That association is the aggregator's alone, nothing in the reviewed sources corroborates it or describes what work passes between the two, and it is the one item in this record that would change the size reading if it turned out to be substantive. [s6, s11, s13, s14]

ZeroThreat's terms of use name ZeroThreat, Inc. at a Wilmington, Delaware address and set Delaware law as governing. Its privacy policy gives the same postal address, and the footer on every page in the record carries a second address in Carol Stream, Illinois.

The certifications in the record come from an outside reviewer rather than a published report. That review lists the product as ISO certified and SOC 2 certified without naming a report, a scope or a date, and no trust page, portal or attestation report appears on the surfaces recorded in the sources. A buyer whose procurement needs the underlying audit has to request it from the company.

The service holds what a scanner needs and a buyer guards. Its privacy policy states that customers supply target URLs, API specifications and authentication credentials for authenticated scans, and that the platform stores scan results and evidence captures. The paid plans offer region-based storage and access control, and the compliance reporting covers GDPR, ISO 27001, PCI DSS and HIPAA. [s1, s2, s3, s9, s11, s12]

ZeroThreat addresses teams that ship faster than their testing cycle. Its CISO page frames the buyer as security leadership, and its free-tool pages pitch the product as a way to save thousands on manual pen tests and tooling.

Price draws the real segment line. The free plan covers one target and one scan credit a month, the paid plan is $100 a month for a single target application, and additional targets cost $75 each. An independent review reaches the matching conclusion, naming small and mid-sized teams buying at a fraction of enterprise pricing as the product's fit.

The plans include compliance reporting, and the named customers sit outside the regulated core. The Professional plan lists continuous compliance coverage for GDPR, ISO 27001, PCI DSS and HIPAA, and the two customers ZeroThreat names are a payroll software company and a web-to-print platform.

The scanning work is the part ZeroThreat built. Its pages describe discovery of endpoints the customer did not supply, authenticated testing across SSO and multi-factor login, API coverage across REST, GraphQL and SOAP with broken object and function level authorization checks, and Playwright rendering for modern single-page applications that the independent review lists among features still marked coming soon.

The payload library is compiled from public sources and the company names the language models behind the analysis. ZeroThreat's engine page states that a KNN algorithm picks payloads from a library compiled out of public CVE databases, vulnerability disclosures and reported attack patterns, and its newsroom describes the platform as driven at its core by large language models such as GPT-4 Turbo and Gemini Ultra. Its agentic page, which carries a Coming Soon label, describes customer-managed models naming GPT, Claude and Grok.

What the AI is claimed to buy is fewer false alarms, and that claim is unaudited. The site records 99.9 percent detection accuracy, the outside review records the company citing 98.9 percent, and that reviewer states the figures come from the company's own testing rather than an independent benchmark.

Entry is self-serve. A prospect signs up, receives five scan credits valid for 15 days without a card, and reads a published price for every tier.

Publicity does work a sales team would. ZeroThreat runs a newsroom, and its own nominee page in the Cybersecurity Excellence Awards asks readers to cast votes for it by sharing that page, each share counting as one Community Choice vote. The program states that jury winners are chosen by expert judges while Community Choice winners are determined by public voting, so the two recognitions are not the same kind of signal.

Both customer stories are published by ZeroThreat itself. They name Code House and OnPrintShop, and the customer stories index adds seven testimonials across six roles without naming an employer beside any of them, so a buyer checking references has two accounts and no independent one.

ZeroThreat publishes every price, which is unusual in this category and useful to a buyer sizing a deal alone. The Free plan costs nothing and gives one scan credit a month against one target with a limited preview of findings. Professional is $100 a month for one target application, with additional targets at $75 each. Pay Per Scan sells credits at $25 each.

The free tier is the entry rung of the same ladder rather than a separate product. The pricing page states that the free plan uses the same detection engine as the paid plans and shows a limited insights preview, and the free scanner and free pentesting pages route a visitor into the same signup.

The unit is the target application, which suits a team with a handful of applications and works against one with many. A buyer with twenty applications pays for twenty targets, so the per-target plan fits a team scanning a few applications constantly while the credit pool fits a team scanning many applications occasionally.

An unauthenticated scan asks nothing of the customer's infrastructure. That is the whole content of the zero-setup claim ZeroThreat leads with. Scanning behind a login adds a step, and the review describes a Chrome extension that records the login flow for the scanner to replay.

Pipeline wiring is where the product embeds. ZeroThreat's integrations page lists connectors for the build systems and issue trackers a development team already runs. Wired that way, a periodic scan becomes a step in a release.

Deployment options stop short of self-hosting. Internal applications are reached through an on-premises proxy rather than a full self-hosted install, and the paid plans offer region-based storage and access control for customers with data residency obligations.

The legal identity is documented and the assurance is not. ZeroThreat's terms of use name ZeroThreat, Inc. at a Wilmington, Delaware address under Delaware law, and its privacy policy repeats that address while the footer on every page in the record also carries a Carol Stream, Illinois address.

The certifications in the record come from an outside reviewer rather than a published report. That review lists the product as ISO certified and SOC 2 certified without naming a report, a scope or a date, and no trust page, portal or attestation report appears on the surfaces recorded in the sources.

The data at stake raises the bar. ZeroThreat's privacy policy states that it processes target URLs, API specifications and authentication credentials supplied for authenticated scans, along with scan results and evidence captures. A customer running authenticated scans hands its own application credentials to a company the record sizes at four employees in one source and at one to nine in another.

Nothing in the reviewed record is built on ZeroThreat by anyone else. It consumes the ecosystem through connectors into pipelines and trackers and offers custom API and webhook support, and the record shows no marketplace and no partner program, so every capability a buyer gets here comes off ZeroThreat's own roadmap.

The open-source ecosystem shows up as input, and the sources disagree about whether it has arrived. ZeroThreat's pricing page lists Nuclei inside the coverage a paid plan buys, while the independent review lists Nuclei template support as still coming soon.

The model layer is the one place the product plans to open outward. Its agentic page describes customer-managed models, which would make the reasoning layer something the customer supplies rather than something ZeroThreat owns.

One name carries the company in public. Dharmesh Acharya appears as co-founder in ZeroThreat's own October 2025 newsroom item and as the founder on an aggregator profile, and no other person is identified as working for the company anywhere in the reviewed sources.

The site does not introduce anyone. Its About Us page returns 404, so a buyer evaluating who builds the scanner has the founder's name and little else. Neither a prior build nor an exit nor a publication record for him appears in the record.

The headcount figure needs its second entity to read correctly. An aggregator records ZeroThreat at four employees as of May 2026, the awards program's entry records a company size of one to nine, and the same aggregator lists the company as associated with Radix Software Services Private Limited, an Indian firm incorporated in 2010 that it records at 524 employees. That association is the aggregator's alone, nothing else in the record corroborates it, and it would change the size reading if it turned out to be substantive.