Licensed by scope, not by seat
Pricing follows the environment you deploy against — one network, several networks, or none at all. Every scope runs the same full agent inside your infrastructure, and your whole team works on the same license.
There is no per-seat meter and no SaaS tier. Quotes are named per environment, after a scoping call.
- counted
- Deployment scope
- not counted
- User seats
- included
- The full agent — web UI, CLI, and API
- listed
- No public price list
- issued
- After a scoping call, named to your environments
structural readout — no amounts published
Three scopes, one agent
Choose by network topology, not team size. Each scope carries the one below it, so moving up changes the boundary you deploy against — never the test itself.
Every scope ends with a request, not a number. Real prices exist once a scoping call names the environments.
- 01
Single environment
One network. The full agent.
The complete platform — orchestration, the private LLM, and the scanning engine — deployed against one network you own. One boundary, one audit trail, one license for everyone on the team.
scope 01 includes
- Web dashboard for the whole team
- xrazor-cli for scripting and automation
- REST, GraphQL, and gRPC API with webhooks
- Custom HTTPS deployment — company.xrazor.local/dashboard
- Audit trail on every scan, finding, and action
- 02
Multi-environment
Everything in single, plus the pipeline.
For teams running more than one environment — production, staging, and the estate behind them. Scans trigger where code already moves, and findings land in the tracker your engineers already use.
adds over 01
- CI/CD triggers — GitHub Actions, GitLab CI, Jenkins, Azure DevOps
- Multiple scan profiles — comprehensive, devsecops
- Issue-tracker push — Jira, Linear, ServiceNow
- 03
Air-gapped
Everything in multi, plus no upstream.
For classified and restricted networks where nothing reaches the internet, and nothing tries to. The scan is identical to every other scope — air-gap changes the network, not the test.
adds over 02
- Offline install media
- No upstream dependency at runtime
- Restricted-network support
- Same capabilities, same audit trail as the connected scopes
What every scope includes
No cheaper tier with pieces removed. These capabilities ship in every scope, in every network, on every run.
- Asset discovery
- Enumerates and maps every host, endpoint, and API in scope — including the ones nobody documented.
- AI-led attack simulation
- The on-prem LLM reads context and orchestrates attack paths a scanner would never try on its own.
- Hybrid scanning
- AI reasoning drives industry-proven scanners, so every finding arrives with the reasoning that produced it.
- Correlation and deduplication
- Signals are merged into one ranked set. One root cause is one finding, not forty alerts.
- Severity-ranked findings
- Critical, High, Medium, Low — each with remediation context attached, so a ticket lands with the fix already implied.
- SARIF output
- Findings export as SARIF into the tooling your pipeline already reads.
- Audit trail
- Every scan, finding, and remediation action is logged. Compliance evidence is a byproduct of the work.
Straight answers
Four questions that decide most evaluations, answered before you have to ask them.
Is there a SaaS mode?
No — and that is the point. The agent runs inside your network with no upstream connection to us. There is no hosted tier to compare against, nothing to proxy, and no third-party cloud for your compliance team to review.
How is licensing counted?
Per deployment scope, not per seat. Your engineers, your pentest leads, and your CISO all work on the same license. You pick the scope by network topology — one environment, several, or air-gapped — and the headcount is nobody's business but yours.
Does it work with no internet at all?
Yes. The air-gapped scope ships on offline install media with no upstream dependency at runtime. The private LLM, the scanners, and the orchestration all run locally, so a sealed network gets the same test a connected one does.
What does it integrate with?
CI/CD — GitHub Actions, GitLab CI, Jenkins, Azure DevOps. Issue tracking — Jira, Linear, GitHub Issues, ServiceNow. SIEM and logging — Splunk, Elastic, Datadog, Sumo Logic. Webhooks and the REST, GraphQL, and gRPC APIs cover everything else.
Tell us the network. We’ll name the scope.
Walk us through what you deploy against — one environment or an estate — and what sits inside it. You get the scope, the quote, and thirty minutes with an engineer running the agent in a network shaped like yours.
- Quotes name environments, not headcount
- The walkthrough runs inside your network
- No data leaves it — before or after you buy