Plans that fit.
Pick the coverage you need today and scale up whenever you're ready — every engagement is scoped to your environment.
Plans
Continuous coverage — everything each plan includes, in full.
Starter
Weekly vulnerability monitoring for a single application. Know what's exposed and how to fix it.
- Website / app scan1 / mo · 5 domains · standard
- Source-code scan1 / mo · 3 repositories · standard
- 7-day scanWeekly · 1 domain · standard
- Team members2
- Data retention3 months
- Dark-web monitoring1 domain
- Weekly scheduled monitoring across all your assets
- 5 scannable assets (domain, IP or application)
- 4 on-demand scans per month
- Unlimited remediation rescans
- Code scanning for 3 repositories (SAST, dependencies, secrets)
- Attack surface discovery on 1 root domain
- Dark web and breach monitoring for your domain
- Client portal, security dashboard and scan history
- Unified weekly report with PDF export
- Security score after every cycle
- 2 users
- 3 months data retention
- Email support
- Bug hunting — manual testing by a specialistBug Hunting Sprint · €2,000.00 one-off →
- Penetration testingWeb Application Penetration Test — Small · €1,900.00 one-off →
- AI exposure detection — available on Business and aboveBusiness · €249.00 / month →
- Remediation workflow and scan comparison — available on Business and aboveBusiness · €249.00 / month →
- AI Remediation AssistantAI Remediation Assistant · €29.00 / month →
- CSV/JSON export, API and Jira — available on Business and aboveBusiness · €249.00 / month →
- Professional onboardingOnboarding profesional · €350.00 one-off →
Business
Full security improvement cycle across your applications, your code, and your external footprint.
- Website / app scan10 / mo · 20 domains · in-depth
- Source-code scan10 / mo · 25 repositories · in-depth
- 7-day scanWeekly · 10 domains · in-depth
- Team members10
- Data retention12 months
- Dark-web monitoring10 domains
- 10% discount on all professional services
- Priority support within one business day
- 12 months data retention
- 10 users
- Audit log
- CSV/JSON export, API access and Jira integration
- Management reporting
- Remediation SLA tracking
- Prioritization by CVSS and EPSS
- Scan-to-scan comparison and score history
- Remediation workflow and vulnerability tracking
- Dark web monitoring for 3 domains and 10 monitored identities
- Attack surface discovery on 3 root domains, with new assets scanned automatically
- AI exposure detection — LLM keys, prompt leaks, AI endpoints
- Code scanning for 25 repositories (SAST, dependencies, secrets)
- Unlimited remediation rescans
- 20 on-demand scans per month
- 20 scannable assets (domain, IP or application)
- Weekly scheduled monitoring across all your assets
- Everything in Starter
- Professional onboardingOnboarding profesional · €350.00 one-off →
- Infostealer log monitoring — available on Scale and aboveScale · €599.00 / month →
- SSO/SAML, SIEM and webhooks — available on Scale and aboveScale · €599.00 / month →
- ServiceNow integrationServiceNow Integration · €39.00 / month →
- AI Remediation AssistantAI Remediation Assistant · €29.00 / month →
- Penetration testingWeb Application Penetration Test — Small · €1,900.00 one-off →
- Bug hunting — manual testing by a specialistBug Hunting Sprint · €2,000.00 one-off →
Scale
Broader coverage, deeper intelligence, and the integrations your security workflow already runs on.
- Website / app scan30 / mo · 60 domains · in-depth
- Source-code scan50 / mo · 100 repositories · in-depth
- 7-day scanWeekly · 40 domains · in-depth
- Team members25
- Data retention25 months
- Dark-web monitoring20 domains
- 15% discount on all professional services
- Assisted onboarding included
- Priority support within 4 hours, with a quarterly posture review
- 24 months data retention
- 25 users
- Multi-project organization
- API access with extended rate limits
- ServiceNow, SIEM and webhook integrations
- SSO/SAML
- Executive reporting
- AI Remediation Assistant included
- Risk-based prioritization enriched with CISA KEV
- Dark web monitoring for 10 domains and 30 monitored identities, including infostealer logs
- Attack surface discovery on 10 root domains
- AI exposure detection — LLM keys, prompt leaks, AI endpoints
- Code scanning for 100 repositories (SAST, dependencies, secrets)
- Unlimited remediation rescans
- 60 on-demand scans per month
- 60 scannable assets (domain, IP or application)
- Weekly scheduled monitoring across all your assets
- Everything in Business
- Multiple organizations and custom RBAC — available on EnterpriseEnterprise · Talk to an expert →
- Dedicated environment — available on EnterpriseEnterprise · Talk to an expert →
- Daily monitoring — available on EnterpriseEnterprise · Talk to an expert →
- White-label portalWhite-Label Portal · €300.00 / month →
- Penetration testingWeb Application Penetration Test — Standard · €3,500.00 one-off →
- Bug hunting — manual testing by a specialistContinuous Bug Hunting · €950.00 / month →
Enterprise
A continuous security platform for multiple organizations, with your branding, your environment, and your SLA.
- Website / app scanUnlimited
- Source-code scanUnlimited
- 7-day scanWeekly
- Penetration testUnlimited
- Security auditUnlimited
- Internal network scanUnlimited
- Team membersUnlimited
- Dark-web monitoringIncluded
- 20% discount on all professional services
- Full onboarding run by our team
- Dedicated support channel and named account manager
- Contractual platform SLA
- Data retention agreed per contract
- Unlimited users
- Dedicated environment
- White-label portal on your own domain
- Executive and custom reporting
- ServiceNow, SIEM, ITSM and webhook integrations
- Complete API access
- SSO/SAML
- Custom role-based access control
- Multiple organizations and business units in one console
- Dark web monitoring with custom scope, including infostealer logs
- Unlimited remediation rescans
- On-demand scans agreed per contract
- Negotiated volumes of assets, repositories and domains
- Weekly scheduled monitoring across all your assets
- Everything in Scale
- Daily monitoringDaily Monitoring · €300.00 / month →
- Penetration testingComprehensive Security Assessment · €800.00 / day →
- Bug hunting — manual testing by a specialistContinuous Bug Hunting · €950.00 / month →
Services
Scoped engagements delivered by our team — pentests, code review, OSINT and more.
Web Application Penetration Test — Small
A three-day manual test of a single application with one or two user roles and a limited number of flows. Delivered as a report with reproducible findings, severity ratings, and remediation guidance.
- In the price
- No — paid separately
- Additional retest
- €650.00 — Retests are performed within 90 days of the report and cover only the findings it contains, not functionality added since. One retest is one round: if findings remain open after it, a further round is charged separately. The retest runs in the same environment as the original test.
Web Application Penetration Test — Standard
A five-day manual test of a SaaS product or business application with multiple user roles and an API. Covers authorization between roles, business logic, and the API surface behind the interface.
- In the price
- Yes — one retest within 90 days of the report
- Covers
- Only the findings reported in the original test. Each is confirmed as fixed, partially fixed, or still present, using the same reproduction steps. Where a fix addresses the symptom rather than the cause, we say so and check whether the vulnerability remains reachable by another path. You receive an updated report and a signed statement of remediation. Functionality added after the original test is not covered.
- Additional retest
- €650.00 — The included retest is one round. If findings remain open after it, or if you need verification after the 90-day window, a further retest is charged at €650 per round. Retests run in the same environment as the original test.
Web Application Penetration Test — Complex
An extended manual test of a platform where a single authorization flaw has real consequences: multi-tenant data separation, payment logic, and single sign-on.
- In the price
- Yes — one retest within 90 days of the report
- Covers
- Two rounds, both covering only the findings reported in the original engagement. Each finding is confirmed as fixed, partially fixed, or still present, using the same reproduction steps. Where a fix addresses the symptom rather than the cause, we say so and check whether the vulnerability remains reachable by another path. Each round produces an updated report, and the final one a signed statement of remediation. Functionality added after the original engagement is not covered.
- Additional retest
- €650.00 — Both included rounds are used within 90 days of the report. Beyond them, or beyond the window, further retests are charged at €650 per round. Retests run in the same environment as the original engagement.
External Infrastructure Penetration Test
A manual test of your internet-facing infrastructure — up to 10 IP addresses. What is exposed, what is exploitable, and what an attacker reaches from the outside without credentials.
- In the price
- No — paid separately
- Additional retest
- €650.00 — Retests are performed within 90 days of the report and cover only the findings it contains, not systems or services added since. One retest is one round: if findings remain open after it, a further round is charged separately. The retest covers the same IP addresses as the original test.
Mobile Application Penetration Test
A five-day manual test of one mobile application, iOS or Android, including the backend API it communicates with. Covers what the app stores, what it transmits, and what its API accepts.
- In the price
- Yes — one retest within 90 days of the report
- Covers
- Only the findings reported in the original test, across both the application and its backend API. Each is confirmed as fixed, partially fixed, or still present, using the same reproduction steps. The retest is performed on a new build you provide; features added since the original test are not covered. You receive an updated report and a signed statement of remediation.
- Additional retest
- €650.00 — The included retest is one round. If findings remain open after it, or if you need verification after the 90-day window, a further retest is charged at €650 per round. Retests run in the same environment as the original test.
AI / LLM Application Penetration Test
A five-day manual test of an application built on a language model. Covers prompt injection, data leakage, and what the model is able to do on a user's behalf.
- In the price
- Yes — one retest within 90 days of the report
- Covers
- Only the findings reported in the original test. Each is confirmed as fixed, partially fixed, or still present. For this class of vulnerability, the retest also states which findings have been mitigated by controls and which remain residual risk by design — prompt injection cannot always be eliminated, and we report honestly where a control reduces risk rather than removing it. Model, tooling or prompt changes made since the original test are not covered.
- Additional retest
- €650.00 — The included retest is one round. If findings remain open after it, or if you need verification after the 90-day window, a further retest is charged at €650 per round. Retests run in the same environment as the original test.
Remediation Retest
A specialist verifies that the vulnerabilities found in your penetration test are actually fixed, and issues an updated report reflecting your current state.
- In the price
- No — paid separately
- Additional retest
- This service is itself a retest. It verifies the findings of a previous 4Tify engagement, within 90 days of the original report, and covers one round. Further rounds are booked as additional units of this service.
Manual Secure Code Review
A specialist reads your code the way an attacker would, finding the flaws that only appear when you can see the logic behind the interface.
Bug Hunting Sprint
Three days of unstructured manual hunting on your live application. No checklist, no methodology to complete — a specialist looking for the one thing nobody thought of.
Continuous Bug Hunting
A specialist working on your application every month, who knows it well enough to spot what changed and where the new risk went.
OSINT Exposure Investigation
A specialist maps everything publicly discoverable about your organization and up to five key people — and everything already leaked about you in breach data and criminal marketplaces.
Comprehensive Security Assessment
Every layer examined in one engagement — application, code, infrastructure, exposure — and a single answer to the question your board is actually asking: how exposed are we, and what do we do first?
Add-ons
Extend any subscription — extra scans, assets, users or capabilities.
Additional Asset
Add one more asset to your plan at any time. Each asset is scanned on your weekly schedule and counts toward your on-demand scans.
- Website / app scan+1 domain
Additional Repositories (pack of 10)
Extend code scanning to 10 more repositories. Each one is scanned weekly for vulnerabilities, vulnerable dependencies, and exposed secrets.
- Source-code scan+10 repositories
Additional Monitored Domain
Extend attack surface discovery and dark web monitoring to one more root domain. Includes all subdomains discovered under it.
- Dark-web monitoring+1 domain
Monitored Identity
Monitor one individual's work identity for leaked credentials and personal data appearing in breach data and criminal marketplaces.
On-Demand Scan Pack (10 scans)
Ten extra scans you can trigger whenever you want, on top of your plan's monthly allowance. Remediation rescans remain unlimited and are never counted.
- Website / app scan10 × single-use
Additional User
Add one more person to your organization's account, with the role and permissions you assign.
- Team members+1
Extended Data Retention
Add 12 months to your plan's retention period. Keep scan history, reports, and score evolution available for longer.
- Data retention+12 months
AI Remediation Assistant
Turn each finding into a concrete fix for your stack: the affected code or configuration, the change to make, and how to verify it worked.
ServiceNow Integration
Push findings into ServiceNow as incidents or change requests, with status synchronized back into 4Tify.
White-Label Portal
Deliver 4Tify to your own clients under your brand, on your own domain, with your logo and colors.
Daily Monitoring
Move your scheduled monitoring from weekly to daily, with results delivered every morning.
Dedicated Environment
Run 4Tify on infrastructure reserved for your organization alone, in the region you choose.
Onboarding profesional
A guided setup session with a 4Tify specialist. Your assets, repositories, integrations and workflow configured with you, not left to documentation.
Every engagement is scoped to your environment · VAT excluded.
Questions, answered.
The plans are a starting point. Every engagement is scoped to your environment, so the final figure reflects your real assets and risk — never a surprise.
Yes — most clients start small and move up as their attack surface grows. There's no lock-in.
Absolutely. Many teams pair a one-off pentest with an always-on monitoring plan. We'll help you assemble the right mix.
Always. Our engineers embed with your team, building protection and continuous scanning into the way you ship.
Not sure which plan fits?
Book a no-obligation scoping call — we'll map your attack surface and recommend the right starting point.
Talk to an expert