Vulnerability Management And Penetration Testing — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Port Scanning & Service Enumeration
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNmap/RustScan/Masscan: Free OSS unlimited. Nessus Essentials Free 16 IPs. Nessus Pro $3,990/yr. Tenable.io $2,500/yr 100 assets, $0.25/asset/day overage. Over 100 assets +$25/asset/yr
Asset Discovery / Attack Surface Management
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsShodan Free 100 queries/mo, 1 scan credit. Pro $59/mo 10k results/mo. Enterprise $299/mo 5k query credits, $0.10/query overage. Censys Free 250 queries/mo, Pro $199/mo 2.5k queries. AssetNote $500/mo 5k assets
Vulnerability Scanner (Network/Infrastructure)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free OSS unlimited assets self-hosted. Tenable.io $2,500/yr 100 assets ($25/asset/yr), $0.25/asset/day over. Rapid7 InsightVM $2,000/yr 500 assets ($4/asset), $5/asset/yr over. Qualys VMDR $20k/yr 1000 assets $20/asset/yr over, $1.67/asset/mo
Web Application Vulnerability Scanner (DAST)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsZAP/Nuclei Free OSS unlimited. Burp Pro $449/yr/user, Enterprise $6,995/yr 10 agents ($699/agent). Acunetix $4,495/yr 25 targets ($180/target), $150/target/yr over. Over scans $0.50/scan
Secrets Scanning & Leak Detection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTruffleHog/Gitleaks Free OSS unlimited repos. GitGuardian Free 25 devs, 1k commits, 1 historical scan. Business $20/dev/mo after ($240/dev/yr), 10k incidents/mo incl., $0.10/incident over. GitLab Secret Detection Free in Ultimate
SSL/TLS & Certificate Vulnerability Scanning
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsTestSSL.sh/SSLyze Free OSS. Qualys SSL Labs Free 400 scans/day. Detectify Starter $1,584/yr 250 domains ($6.3/domain/mo), $20/scan over. Over certs $2/cert/mo
DNS Security & Subdomain Enumeration / Takeover Detection
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsAmass/Subfinder/Sublist3r Free OSS unlimited. SecurityTrails Free 50 queries/mo. API $99/mo 2k queries ($0.05/query), $0.05/query overage. Enterprise $399/mo 20k queries
Exploitation Framework
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMetasploit Framework/ExploitDB/SearchSploit Free OSS. Metasploit Pro $15,000/yr 1 user. Cobalt Strike $5,900/yr/user team server included. Brute Ratel C4 $2,499/yr/user. No overage, seat-based
Password Auditing / Credential Stuffing Testing
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsHashcat/John/Hydra/Medusa Free OSS unlimited. Hashcat.Team Server $0. Elcomsoft $599 one-time Pro, $299/yr maintenance, $99/node/yr over. Online hash check free
Remediation Workflow & Ticketing (SecOps)
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsJira Free 10 users, 2GB. Standard $8.15/user/mo $81.5/mo 10 users. Linear Free 250 issues. Standard $10/user/mo. ServiceNow SecOps $50k/yr starter (approx $120/user/mo enterprise min 20 users), $50/incident over
Penetration Testing Reporting & Documentation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsDradis CE Free OSS self-hosted unlimited projects. PlexTrac Community Free 1 user. Starter $119/user/mo $1,428/yr/user. Faraday Pro $4,500/yr 10 users ($450/user/yr), $400/user/yr over
Internet-wide Scanning API / External Recon
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShodan Free 100/mo. Developer $59/mo 10k results. Enterprise $299/mo 5k queries $0.10/query over. Censys Free 250/mo Pro $199/mo 2.5k queries $0.08/query over. ZoomEye $399/mo 30k queries $0.02/query over
Container Image Vulnerability Scanning
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsTrivy/Grype/Clair Free OSS unlimited scans. Snyk Free 200 tests/mo. Team $25/dev/mo $300/dev/yr 5k tests/mo, $0.02/test over. Enterprise $1,800/dev/yr custom
API Security Testing & Discovery
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZAP/crAPI Free OSS. Burp Pro $449/yr/user includes API scanning. Salt Security $36k/yr 10 APIs ($3k/API/yr) $3,500/API/yr over. APIsec $30k/yr base $2k/API/yr over
Vulnerability Intelligence Feed / CVE Database
Persistent storage for your app’s data — users, products, orders. The single most important architectural decision for most projects.Pricing & free-tier limitsNVD Free unlimited 5 req/30s w/o key, 50 req/30s w/ key. Vulners Free 100 req/day, Pro $199/mo 50k req $0.01/req over. VulnDB $30k/yr 10k lookups $3/lookup over, $2.5k/mo. VulnCheck Community free 500 CVEs
Vulnerability Prioritization & Risk Scoring
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsEPSS/CVSS Free OSS. Brinqa Starter $45k/yr 1k assets $45/asset/yr. Kenna (Cisco VM) $50k/yr 2k assets $25/asset/yr over. $5k for extra connector. Vuln prioritization $0.50/asset/mo over
Asset Inventory & CMDB for Vuln Management
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT Free OSS self-hosted unlimited. AssetTiger Free 250 assets, Pro $120/mo 1000 assets $0.12/asset/mo $0.20/asset over. Lansweeper Free 100 assets, Starter $1,795/yr 2000 assets $0.90/asset/yr over, $1.20/asset over
Network Traffic Analysis for Vuln Context
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZeek/Wireshark/Suricata Free OSS unlimited. ET Pro Rules $35k/yr. ExtraHop $25k/yr 1Gbps sustained, $7k/Gbps over. Corelight Sensor $50k/yr 10Gbps
Secure File Transfer for Pentest Reports
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsNextcloud/OnionShare Free OSS self-hosted unlimited. Tresorit Free 5GB, Premium $12.50/mo 100GB $0.12/GB over. Kiteworks $25/user/mo min $30k/yr enterprise, $10/GB over egress
How this small scale vulnerability management and penetration testing checklist works.
Each requirement below is something a small scale vulnerability management and penetration testing build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.