Detectify

Detectify combines external attack surface management with dynamic application security testing, continuously mapping what an organisation exposes to the internet and then testing each asset for exploitable vulnerabilities. The payloads come partly from Detectify's own research and partly from Crowdsource, a network of more than 400 ethical hackers who submit real attack techniques rather than generic signatures, which is the company's clearest point of difference from a conventional scanner.

Coverage extends to REST and GraphQL APIs from the Standard tier up, and CI/CD integration on Professional lets scanning run inside a deployment pipeline rather than as a separate quarterly exercise. Detectify AB is based in Stockholm, so the reports generated from scanning a customer's infrastructure — which can include internal URLs, parameters and, occasionally, exposed credentials — are processed under Swedish and EU law.

Pricing is published rather than quote-only, down to a point: a free Starter tier covers up to five users and 100 assets, Standard is €2,500 a year, Professional €5,000, and Enterprise €15,000 for unlimited users and assets. That transparency stops where most vendors hide it — mid-market — which is unusual in application security. The honest limit: it is a scanner and attack-surface tool, not a WAF or CDN, so it finds exposure rather than blocking it.

What Detectify does well

• External attack surface management plus DAST in one platform
• Crowdsource payloads from 400+ ethical hackers
• REST and GraphQL API scanning
• Published pricing from a free tier to €15,000/year
• Swedish company, EU jurisdiction

Where Detectify falls short

• Finds vulnerabilities rather than blocking attacks — not a WAF or CDN
• Standard tier caps at 750 assets and 10 users
• CI/CD integration reserved for Professional and above
• Enterprise pricing jumps sharply to €15,000/year

Standout feature. Published pricing from a free tier to €15,000 a year — rare transparency in enterprise application security.