Choose the coverage that fits your products today. Every plan brings product context, high-signal analysis, and supported AI remediation into one workspace.
No public price tags or surprise scanner add-ons. We scope the right plan with your team.
For small teams building a repeatable product-security practice.
For growing companies securing multiple products continuously.
For complex environments that need private access and centralized control.
Plans scale the amount of coverage, automation, control, and support. We do not weaken the security engine for smaller teams.
Connect design, code, applications, APIs, mobile, and remediation.
SAST, SCA, IaC, secrets, CI/CD, and malware scanning.
Turn supported findings into reviewable fixes using included credits.
Keep product, engineering, DevOps, architecture, and security aligned.
Exact product and assessment allowances are confirmed with your team.
| Capability | Starter | GrowthMost popular | Enterprise |
|---|---|---|---|
| Platform and collaboration | |||
| Products and projects | Defined in agreement | Higher allowance | Custom |
| ThreatMind AI credits | 3,000 at onboarding | 10,000 at onboarding | Custom at onboarding |
| Shared workspace and roles | Included | Included | Included |
| PDF, Markdown, and HTML reports | Included | Included | Included |
| Threat modelling | |||
| Contextual threat modelling | Included | Included | Included |
| Document and architecture imports | Included | Included | Included |
| Recurring model refreshes | Limited | Higher volume | Custom volume |
| Organization-wide governance | — | — | Included |
| Code security | |||
| SAST, SCA, IaC, secrets, CI/CD, and malware | Included | Included | Included |
| Automatic pull and merge-request review | Limited volume | Continuous | Custom volume |
| AI triage and supported AutoFix | Included | Included | Included |
| Advanced blocking policies and path rules | — | Included | Included |
| Self-hosted source control | — | — | Included |
| Web, API, and mobile security | |||
| Web, REST, GraphQL, and WebSocket testing | On demand | Recurring | Custom and concurrent |
| Authenticated testing | Limited | Included | Included |
| Private target connectivity | — | — | Included |
| Android and iOS static analysis | Limited | Higher volume | Custom volume |
| Supported web, API, and mobile AutoFix | Included | Included | Included |
| Cloud and runtime | |||
| Multi-cloud posture | — | Included | Included |
| Cloud identity risk and attack paths | — | Included | Included |
| Kubernetes posture | — | Included | Included |
| Kubernetes admission and runtime protection | — | — | Included |
| Private deployment requirements | — | — | By agreement |
| Integrations and support | |||
| Cloud source-control integrations | Standard | All supported | All supported |
| Jira, Asana, Linear, Notion, Miro, and draw.io | Standard handoff | Included | Included |
| Enterprise OIDC SSO | — | — | Included |
| Onboarding and support | Standard | Guided | Priority |
Need more AI capacity? Purchase additional credits directly from your ThreatMind workspace whenever your balance runs low.
Each plan starts with a one-time credit allocation during onboarding. Credits cover AI-assisted analysis and remediation across ThreatMind and do not reset every month. When your balance runs low, top up directly from your workspace.
Have a different requirement? We can work through it during a product demo.
Talk to salesThreatMind spans products, repositories, authorized pentests, mobile packages, cloud accounts, and deployed environments. We tailor the plan to the coverage and assessment volume your team actually needs instead of forcing every customer into the same footprint.
AI credits cover AI-assisted work such as contextual threat analysis, code-review reasoning, agentic testing, mobile and cloud risk analysis, and supported AutoFix generation. Viewing, assigning, or exporting an existing result does not consume credits.
You can purchase additional credits directly from your ThreatMind workspace whenever your balance runs low. Topping up does not require a plan change or a conversation with sales.
Yes. Supported AI AutoFix workflows are available across the plans and draw from your available ThreatMind AI-credit balance. Generated changes remain reviewable before your team ships them.
Yes. You can begin with the part of the lifecycle that matters most today, then connect more product context and security surfaces as your program grows.
Enterprise supports private target connectivity and self-hosted source-control workflows. We will review your environment and access requirements during the sales process.
Tell us what you design, build, test, and run. We'll help scope the coverage your team needs.
Talk to sales
