VulnSign Editions
Choose the VulnSign edition for your team
Start with Community, equip AppSec teams with Professional, or scale security operations with Enterprise.
Save 49%
Community
For individual security practitioners who want a capable local DAST and manual testing workspace.
Free
- Advanced manual pentesting workspace
- Active & passive scanning
- Real-browser spider crawl
- HTTP proxy & request history
- Quick port and subdomain scans
- Technology fingerprinting
- Basic HTML reporting
ProfessionalPopular
For AppSec teams that need 64 features across advanced testing, automation, AI, and reporting.
$49/month
- Everything in Community
- Mobile penetration testing
- 25 targets, 10 users & 3 concurrent scans
- Custom scan profiles, policies & payloads
- Scheduled scans, issue retest & scan diff
- Replacer, Intruder, breakpoints & WebSocket
- Full port, subdomain & Android testing
- AI assistant, bulk triage & issue chat
- Full technical & executive reporting
- CI/CD & issue tracker integrations
- Roles, approvals, health info & system logs
Enterprise
For organizations that need the complete 76-feature platform, governance, and scale.
Custom
- Everything in Professional, without limits
- All 76 platform features
- AI scan planner & attack chains
- Distributed scanner agents & unlimited scale
- Multi-persona authentication
- Custom roles, trends & backup
- Bypass attack strength
- Premium Support & Custom SLA
76 platform features
Compare every VulnSign edition
This matrix follows the same feature catalog and edition hierarchy used by the VulnSign application. Every edition includes the capabilities of the edition before it.
| Capability | Community | Professional | Enterprise |
|---|---|---|---|
| Usage limits | |||
| Targets | 3 | 25 | Unlimited |
| Users | 1 | 10 | Unlimited |
| Concurrent scans | 1 | 3 | Unlimited |
| Workspaces | 1 | 5 | Unlimited |
| API keys | 1 | 5 | Unlimited |
| CI/CD integrations | — | 1 | Unlimited |
| Issue tracker integrations | — | 1 | Unlimited |
| Targets | |||
| Add and manage targets | Included | Included | Included |
| Target groups | Not included | Included | Included |
| Technical contacts on targets | Not included | Included | Included |
| All application types | Not included | Included | Included |
| Scanning | |||
| Spider crawl | Included | Included | Included |
| Active scan (default policy) | Included | Included | Included |
| Passive scan | Included | Included | Included |
| Custom scan profiles | Not included | Included | Included |
| Custom scan policies | Not included | Included | Included |
| Policy optimization | Not included | Included | Included |
| Scheduled scans | Not included | Included | Included |
| Bypass attack strength | Not included | Not included | Included |
| Custom attack payloads | Not included | Included | Included |
| Manual crawl | Not included | Included | Included |
| Import crawl from file | Not included | Included | Included |
| Scanner configuration | Not included | Included | Included |
| Configurable attack strength | Not included | Included | Included |
| Issues | |||
| View and filter issues | Included | Included | Included |
| Issue retest | Not included | Included | Included |
| Issue assignment | Not included | Included | Included |
| Issue tags | Not included | Included | Included |
| Issue trends | Not included | Not included | Included |
| Network port scanning | |||
| Quick port scan (common ports) | Included | Included | Included |
| Custom port lists | Not included | Included | Included |
| Full port scan (1-65535) | Not included | Included | Included |
| Scan configuration | Not included | Included | Included |
| Compare scans | Not included | Included | Included |
| Scheduled port scans | Not included | Included | Included |
| Authenticated port test | Not included | Not included | Included |
| Subdomain enumeration | |||
| Built-in wordlist enumeration | Included | Included | Included |
| DNS zone transfer | Not included | Included | Included |
| Certificate transparency lookup | Not included | Included | Included |
| SRV record discovery | Not included | Included | Included |
| Custom wordlist | Not included | Included | Included |
| Takeover detection | Not included | Included | Included |
| Information leak detection | Not included | Included | Included |
| DNS resolver configuration | Not included | Included | Included |
| Large wordlist support | Not included | Included | Included |
| Permutation-based discovery | Not included | Not included | Included |
| Multi-host enumeration | Not included | Not included | Included |
| Auto-forwarding | Not included | Not included | Included |
| Workspace tools | |||
| HTTP proxy & request history | Included | Included | Included |
| Replacer | Not included | Included | Included |
| Intruder | Not included | Included | Included |
| HTTP breakpoints | Not included | Included | Included |
| WebSocket tooling | Not included | Included | Included |
| Android testing | Not included | Included | Included |
| Technologies | |||
| Technology fingerprinting | Included | Included | Included |
| CVE lookup | Not included | Included | Included |
| Risk assessment | Not included | Included | Included |
| Reports | |||
| Basic HTML report | Included | Included | Included |
| Full report | Not included | Included | Included |
| Executive summary | Not included | Included | Included |
| HTTP request/response details | Not included | Included | Included |
| Recommendations section | Not included | Included | Included |
| Attacked URLs list | Not included | Included | Included |
| False-positive filter | Not included | Included | Included |
| Teams | |||
| Single-user account | Included | Included | Included |
| System roles | Not included | Included | Included |
| Approval workflow | Not included | Included | Included |
| Custom roles | Not included | Not included | Included |
| Settings | |||
| Basic settings | Included | Included | Included |
| Detailed health info | Not included | Included | Included |
| System logs | Not included | Included | Included |
| Settings backup | Not included | Not included | Included |
| Authentication | |||
| Form-based authentication | Included | Included | Included |
| Header / cookie auth | Not included | Included | Included |
| Multi-persona auth | Not included | Not included | Included |
| Integrations | |||
| CI/CD integration | Not included | Included | Included |
| Issue tracker integration | Not included | Included | Included |
| Scanner agents | Not included | Not included | Included |
| AI Assistant | |||
| AI Assistant | Not included | Included | Included |
| AI bulk triage | Not included | Included | Included |
| AI issue chat | Not included | Included | Included |
| Advanced AI (attack chains, compliance) | Not included | Not included | Included |
| AI scan planner | Not included | Not included | Included |
Trial licenses provide Professional access. Enterprise capacity is governed by your deployment and license agreement.
FAQ’s
Questions before you scan?
Learn how VulnSign fits into your environment, security workflow, and team.
No. VulnSign is designed to run offline in your own environment. The desktop GUI manages the platform locally, while authorized teammates on the same network can access the web interface from their browsers.
Put automated and manual testing in one workflow.
See how VulnSign helps your team discover more attack surface, validate risk, and move findings to remediation—without sending security data to a cloud control plane.
Fully offlineCross-platform76 enterprise features