Vulnerability Management And Penetration Testing — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Port Scanning & Service Enumeration
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNmap/RustScan/Masscan: Free OSS unlimited. Nessus Essentials Free 16 IPs. Nessus Pro $3,990/yr. Tenable.io $2,500/yr 100 assets, $0.25/asset/day overage. Over 100 assets +$25/asset/yr
Asset Discovery / Attack Surface Management
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsShodan Free 100 queries/mo, 1 scan credit. Pro $59/mo 10k results/mo. Enterprise $299/mo 5k query credits, $0.10/query overage. Censys Free 250 queries/mo, Pro $199/mo 2.5k queries. AssetNote $500/mo 5k assets
Vulnerability Scanner (Network/Infrastructure)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free OSS unlimited assets self-hosted. Tenable.io $2,500/yr 100 assets ($25/asset/yr), $0.25/asset/day over. Rapid7 InsightVM $2,000/yr 500 assets ($4/asset), $5/asset/yr over. Qualys VMDR $20k/yr 1000 assets $20/asset/yr over, $1.67/asset/mo
Web Application Vulnerability Scanner (DAST)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsZAP/Nuclei Free OSS unlimited. Burp Pro $449/yr/user, Enterprise $6,995/yr 10 agents ($699/agent). Acunetix $4,495/yr 25 targets ($180/target), $150/target/yr over. Over scans $0.50/scan
Secrets Scanning & Leak Detection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTruffleHog/Gitleaks Free OSS unlimited repos. GitGuardian Free 25 devs, 1k commits, 1 historical scan. Business $20/dev/mo after ($240/dev/yr), 10k incidents/mo incl., $0.10/incident over. GitLab Secret Detection Free in Ultimate
SSL/TLS & Certificate Vulnerability Scanning
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsTestSSL.sh/SSLyze Free OSS. Qualys SSL Labs Free 400 scans/day. Detectify Starter $1,584/yr 250 domains ($6.3/domain/mo), $20/scan over. Over certs $2/cert/mo
DNS Security & Subdomain Enumeration / Takeover Detection
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsAmass/Subfinder/Sublist3r Free OSS unlimited. SecurityTrails Free 50 queries/mo. API $99/mo 2k queries ($0.05/query), $0.05/query overage. Enterprise $399/mo 20k queries
Exploitation Framework
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMetasploit Framework/ExploitDB/SearchSploit Free OSS. Metasploit Pro $15,000/yr 1 user. Cobalt Strike $5,900/yr/user team server included. Brute Ratel C4 $2,499/yr/user. No overage, seat-based
Password Auditing / Credential Stuffing Testing
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsHashcat/John/Hydra/Medusa Free OSS unlimited. Hashcat.Team Server $0. Elcomsoft $599 one-time Pro, $299/yr maintenance, $99/node/yr over. Online hash check free
Remediation Workflow & Ticketing (SecOps)
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsJira Free 10 users, 2GB. Standard $8.15/user/mo $81.5/mo 10 users. Linear Free 250 issues. Standard $10/user/mo. ServiceNow SecOps $50k/yr starter (approx $120/user/mo enterprise min 20 users), $50/incident over
Penetration Testing Reporting & Documentation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsDradis CE Free OSS self-hosted unlimited projects. PlexTrac Community Free 1 user. Starter $119/user/mo $1,428/yr/user. Faraday Pro $4,500/yr 10 users ($450/user/yr), $400/user/yr over
Internet-wide Scanning API / External Recon
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShodan Free 100/mo. Developer $59/mo 10k results. Enterprise $299/mo 5k queries $0.10/query over. Censys Free 250/mo Pro $199/mo 2.5k queries $0.08/query over. ZoomEye $399/mo 30k queries $0.02/query over
Container Image Vulnerability Scanning
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsTrivy/Grype/Clair Free OSS unlimited scans. Snyk Free 200 tests/mo. Team $25/dev/mo $300/dev/yr 5k tests/mo, $0.02/test over. Enterprise $1,800/dev/yr custom
API Security Testing & Discovery
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZAP/crAPI Free OSS. Burp Pro $449/yr/user includes API scanning. Salt Security $36k/yr 10 APIs ($3k/API/yr) $3,500/API/yr over. APIsec $30k/yr base $2k/API/yr over
Vulnerability Intelligence Feed / CVE Database
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitsNVD Free unlimited 5 req/30s w/o key, 50 req/30s w/ key. Vulners Free 100 req/day, Pro $199/mo 50k req $0.01/req over. VulnDB $30k/yr 10k lookups $3/lookup over, $2.5k/mo. VulnCheck Community free 500 CVEs
Vulnerability Prioritization & Risk Scoring
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsEPSS/CVSS Free OSS. Brinqa Starter $45k/yr 1k assets $45/asset/yr. Kenna (Cisco VM) $50k/yr 2k assets $25/asset/yr over. $5k for extra connector. Vuln prioritization $0.50/asset/mo over
Asset Inventory & CMDB for Vuln Management
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT Free OSS self-hosted unlimited. AssetTiger Free 250 assets, Pro $120/mo 1000 assets $0.12/asset/mo $0.20/asset over. Lansweeper Free 100 assets, Starter $1,795/yr 2000 assets $0.90/asset/yr over, $1.20/asset over
Network Traffic Analysis for Vuln Context
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZeek/Wireshark/Suricata Free OSS unlimited. ET Pro Rules $35k/yr. ExtraHop $25k/yr 1Gbps sustained, $7k/Gbps over. Corelight Sensor $50k/yr 10Gbps
Secure File Transfer for Pentest Reports
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsNextcloud/OnionShare Free OSS self-hosted unlimited. Tresorit Free 5GB, Premium $12.50/mo 100GB $0.12/GB over. Kiteworks $25/user/mo min $30k/yr enterprise, $10/GB over egress
Penetration Testing Platform (PTaaS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCobalt.io $5,000/test (5-day standard), $12k/test comprehensive (10-day), retest free 30 days. HackerOne Pentest $15k/test. Synack $8k/test. Over: $2k/day pentester $500/retest over
Bug Bounty Platform Setup
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpen Bug Bounty Free 0% fee. HackerOne Community Free platform, Bounty min $100k/yr budget + 20% fee ($20k fee), avg bounty $1k-$5k. Bugcrowd $50k/yr starter + 20% fee, $50k budget min. Private program $0 platform first year promo
Automated Breach & Attack Simulation (BAS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAtomic Red Team/CALDERA Free OSS 300+ tests. SafeBreach Free 10 sims/mo, Enterprise $75k/yr. Pentera $100k/yr 500 IPs ($200/IP/yr) $150/IP/yr over. Cymulate $80k/yr 500 assets, $100/asset over
Red Team Infrastructure / C2 Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSliver/Mythic/Covenant Free OSS unlimited agents. Cobalt Strike $5,900/yr/user team server free. Brute Ratel $2,499/yr/user. Redirector hosting $50/mo extra. No per-agent overage
Active Directory Security Assessment
Interactive assessments, quizzes, or forms that capture structured input from users.Pricing & free-tier limitsBloodHound CE + PingCastle + Purple Knight Free 1 domain unlimited objects. BloodHound Enterprise $25k/yr 1000 users ($25/user/yr) $15/user/yr over. Tenable.ad $15k/yr 1000 users $10/user/yr over
Cloud Security Posture Scanning (CSPM for Vuln)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsProwler/ScoutSuite/CloudSploit Free OSS unlimited accounts. Orca Free 100 assets, $150/asset/yr after. Wiz $35k/yr 1000 workloads ($35/workload/yr) $35/workload/yr over. $0.10/GB scanning over
Compliance & Audit Automation for Vuln Mgmt
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenAudit Free OSS. Vanta $12k/yr 50 employees ($20/emp/mo) $100/emp/mo over (additional). Drata $10k/yr base 50 employees $80/emp/mo over. Auditor access $2k/audit over
Vulnerability SLA & Metrics Dashboard
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsDefectDojo/Grafana Free OSS unlimited. Faraday Pro $4,500/yr 10 users $450/user/yr $400/user/yr over. Brinqa $45k/yr 2k assets dashboard included $50k/yr for VM module, $0 extra for SLA reporting
Patch Management Orchestration
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWSUS/Ansible Free. ManageEngine Free 25 devices, Pro $5/device/mo $60/device/yr. Automox Free 25 devices, $4/device/mo ($48/device/yr) after, $6/device/mo for worklets over. Ivanti $45/device/yr
Continuous Monitoring / SIEM Integration for Vuln Correlation
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsWazuh/ELK/Graylog Open Free OSS unlimited EPS self-hosted. Elastic Cloud Security $95/mo 50GB ingest. Splunk $2,700/yr 10GB/day license, $270/GB/day over, $1,500 ingest over/day. Extra EPS $0.50/EPS/mo
Collaborative Pentest Workspace & Attack Chain Mapping
Professional email on your own domain plus shared docs/calendar. Builds credibility with customers.Pricing & free-tier limitsDradis CE/Faraday CE Free OSS. PlexTrac Pro $119/user/mo $1,428/yr/user 500 reports. Enterprise $199/user/mo $2,388/yr/user unlimited analytics, $150/report export over. Faraday Pro $4,500/yr
How this professional vulnerability management and penetration testing checklist works.
Each requirement below is something a professional vulnerability management and penetration testing build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.