xalgorix
Start scanning

pricing

Autonomous security testing that scales with you

Maximum offensive depth on managed infrastructure: frontier AI reasoning models, parallel headless browser compute, pre-configured out-of-band infra, and zero rate-limit stalls.

Cloud vs self-hosted: see the full comparison →

See exactly what you get: a real sample report →

Packs from $10
Frontier reasoning AI
Zero token rate limits
Managed OOB infra
Safe for production · non-destructive
Evidence for SOC 2 & security reviews
Credits never expire
🪙 Crypto accepted (USDT, Monero, BTC)

Choose how you use Cloud

Subscriptions

Hacker ($49/mo), Pro ($119/mo), and Max ($279/mo) with recurring credits, multi-scan concurrency, and automated testing.

Compare subscriptions →

Credit packs

One-time purchase from $10. No renewal; credits never expire. Ideal for one-off engagements or topping up during a busy month.

See credit packs →

Comparing to traditional pentesting agencies?

Agency web-app pentests typically run $4,000–$20,000+ per engagement (Invicti, 2025). Xalgorix starts at $10 for 10 credits, with verified exploits.

See pricing below

How credits are used

Subscriptions and credit packs are both billed in credits. Here's exactly what a scan costs.

Single scan

1 credit

One target through every phase you select, with up to 40 million tokens of AI analysis included.

Heavy scans

Up to 3 credits

Each time a scan passes another 40 million tokens, it uses 1 more credit, charged as it runs. A scan never costs more than 3 credits.

Wildcard scan

1 credit per live subdomain

Subdomains that don't respond are free, and a completed scan that finds none costs 1 credit for recon. Up to 2 heavy-scan credits can apply to the wildcard scan as a whole.

Failed scans

Base credit refunded

You get the base credit back when a scan fails because of a problem on our side. There's no refund if the target goes offline, becomes unreachable or blocks the scanner mid-scan, and heavy-scan credits aren't refunded.

Example: the 10-credit pack covers 10 standard scans, or 3 if every scan hits the 3-credit maximum. Every charge and refund is listed on your Credits page.

Subscriptions

Monthly credits replenish each renewal and roll over unused balance. Full 22-phase methodology on every plan.

A scan uses 1 credit, up to 3 on heavy targets. How credits are used ↑
Save 20% with annual billing
Hacker
$49/mo

For solo security researchers, bug bounty hunters, and indie founders running regular autonomous assessments.

  • ✓ 60 scan credits / month
  • ✓ 2 concurrent scans
  • ✓ Autonomous security scans
  • ✓ All 22 offensive phases
  • ✓ Exploit-verified findings
  • ✓ Wildcard target scanning
  • ✓ Standard PDF/HTML reports
  • ✓ 90-day findings retention
  • ✓ Standard scan queue
  • ✓ Findings dashboard & history
  • ✓ Public share links
  • ✓ Email support (48h)
Start Hacker

Cancel anytime · No setup fees

Pro
Most Popular
$119/mo

For developers and AppSec engineers running continuous autonomous security testing.

  • ✓ 150 scan credits / month
  • ✓ 4 concurrent scans
  • ✓ Autonomous security scans
  • ✓ All 22 offensive phases
  • ✓ Exploit-verified findings
  • ✓ Wildcard target scanning
  • ✓ Custom-branded PDF reports
  • ✓ 180-day findings retention
  • ✓ Scheduled recurring scans
  • ✓ CI/CD integrations & webhooks
  • ✓ Slack & Discord alerts
  • ✓ Priority scan queue
  • ✓ Password-protected share links
  • ✓ Standard API access
  • ✓ Priority email support (24h)
Start Pro

Cancel anytime · No setup fees

Max
$279/mo

For security consultants, agencies, and power users running high-volume autonomous security assessments.

  • ✓ 360 scan credits / month
  • ✓ 6 concurrent scans
  • ✓ Autonomous security scans
  • ✓ All 22 offensive phases
  • ✓ Exploit-verified findings
  • ✓ Wildcard target scanning
  • ✓ White-label PDF reports
  • ✓ 365-day findings retention
  • ✓ Scheduled recurring scans
  • ✓ CI/CD integrations & webhooks
  • ✓ Slack & Discord alerts
  • ✓ Priority execution
  • ✓ Password-protected share links
  • ✓ Full API access (higher limits)
  • ✓ Priority email & chat support
Go Max

Cancel anytime · No setup fees

✓ Non-destructive verification payloads · Safe for staging & production APIs · Configurable rate limits

Credit packs

One-time purchase. Credits never expire. Ideal for one-off engagements or topping up during a busy month.

A scan uses 1 credit, up to 3 on heavy targets. How credits are used ↑
10 credits
$10
$1.00 / credit
  • · Never expires
  • · Stacks with subscription
  • · Consumed after monthly credits
Buy pack
50 credits
$45
$0.90 / credit
  • · Never expires
  • · Stacks with subscription
  • · Consumed after monthly credits
Buy pack
200 credits
Most Popular
$175
$0.88 / credit
  • · Never expires
  • · Stacks with subscription
  • · Consumed after monthly credits
Buy pack
500 credits
Best Value
$425
$0.85 / credit
  • · Never expires
  • · Stacks with subscription
  • · Consumed after monthly credits
Buy pack

Credit packs add scan credits only. Plan limits, concurrency, and features remain based on your active subscription.

Compare plans

FeatureHackerProMax
Monthly scan credits60 / mo150 / mo360 / mo
Concurrent scans246
Effective unit cost$0.82 / credit$0.79 / credit$0.78 / credit
Scan modesSingle, WildcardSingle, WildcardSingle, Wildcard
All 22 offensive phases✓✓✓
Exploit-verified findings✓✓✓
Findings retention90 days (Standard)180 days (Longer)365 days (Extended)
Report formattingStandard PDF/HTMLCustom-branded PDFWhite-label PDF
Public share links✓✓ + Password protection✓ + Password protection
Scheduled recurring scans—DailyDaily & on-demand
CI/CD integrations & webhooks—✓✓
Slack & Discord alerts—✓✓
Execution queueStandard queuePriority queuePriority execution
API access—Standard APIFull API & higher rate limits
SupportEmail · 48hPriority email · 24hPriority email & chat · 12h

Pricing FAQ

Still unsure? Reach out at hello@xalgorix.com.

How are credits consumed?
Monthly subscription credits are used first. Purchased credits are used afterward and never expire.
Do purchased credits increase my concurrency?
No. Concurrency is determined by your active subscription plan.
Do credit packs unlock Pro or Max features?
No. Credit packs only add additional scan credits. Features remain based on your active subscription tier.
How do wildcard scans consume credits?
1 credit for each live subdomain that gets scanned. Subdomains that don't respond cost nothing, and a completed wildcard scan that finds no live subdomains costs 1 credit for recon. Up to 2 heavy-scan credits can also apply to the wildcard scan as a whole.
What's the concurrent scan limit?
Hacker runs 2 scans at a time, Pro runs 4, and Max runs 6. New scans queue automatically once you hit your plan's ceiling and start as soon as a slot frees up. Upgrades raise the limit immediately.
What happens if I run out of credits?
New scans are blocked until you top up. You can buy a one-time credit pack from the Billing page (delivered instantly) or upgrade your plan for a larger monthly allowance plus higher concurrency.
How does billing work?
Choose monthly billing or save 20% with an annual commitment via Dodo Payments. Annual plans charge the full year upfront; the monthly equivalent is shown for comparison. Credits follow your allowance and billing schedule.
What happens when I upgrade mid-cycle?
Upgrades take effect immediately. You're charged a prorated amount for the days remaining in your current period, and the higher credit allowance and concurrency limit are unlocked instantly. The next renewal is charged at the new plan's full price.
What happens when I downgrade?
Downgrades are scheduled for the end of your current paid period — you keep the higher plan's credits and concurrency until then. On the renewal date, the cheaper plan and its limits take effect. You can cancel a scheduled downgrade any time before it lands.
Can I cancel anytime?
Yes. Cancel from the Billing page; you keep full plan access through the end of the current billing period, and any one-time credit-pack balance stays available indefinitely. There are no cancellation fees.
Will I get a refund if I cancel?
Refunds follow our Refund Policy at xalgorix.com/refund, which covers first-time subscriptions, one-time credit packs, and annual plans. If you cancel, you keep access until the end of the current period. For billing disputes, email billing@xalgorix.com within 14 days.
What payment methods do you accept?
All major credit and debit cards, as well as cryptocurrency (USDT, USDC, Monero, Bitcoin, Ethereum, and 200+ coins). Annual ACH/wire invoicing is available on request — contact sales@xalgorix.com.
Can I pay with cryptocurrency?
Yes. You can purchase subscription plans and credit packs using cryptocurrency (including USDT, USDC, Monero, Bitcoin, and Ethereum). Plans and credits activate immediately upon on-chain confirmation.
How do credits work?
A single scan costs 1 credit, or up to 3 on very large targets. A wildcard scan costs 1 credit per live subdomain: 1 credit is held when it starts, then each live subdomain is billed as it's scanned and the held credit is returned. Every charge and refund appears on your Credits page.
What counts as one scan?
For Single, one target running through every selected phase. For Wildcard, you're billed per live subdomain discovered during recon — if recon finds 8 hosts but only 3 resolve and respond, you pay 3 credits. A completed wildcard scan costs at least 1 credit even if no subdomains respond.
Can a scan cost more than 1 credit?
Yes, but never more than 3. The first credit covers up to 40 million tokens of analysis. Each time a scan passes another 40 million tokens, it uses 1 more credit, charged as it runs. These heavy-scan credits aren't refunded, even if the scan later fails, because they cover analysis that already ran.
Do I get credits back if a scan fails?
If a scan fails because of a problem on our side, its base credit is refunded. If the target goes offline, becomes unreachable or blocks the scanner partway through, the scan isn't refunded, because testing already ran. Heavy-scan credits are never refunded, and for wildcard scans, subdomains already scanned stay billed.
Do unused subscription credits roll over?
Yes — unused subscription credits carry over to the next billing cycle, and your monthly allowance is added on top each renewal. One-time pack credits never expire either.
Do you offer a free trial?
We offer one-time credit packs starting at $10 for 10 credits — no subscription required, and credits never expire. All packs unlock the full 22-phase methodology.
Is it safe to run Xalgorix against production applications?
Yes. Xalgorix uses non-destructive proof-of-exploitation payloads. It verifies vulnerabilities (such as authorization bypasses, SQL injections, or secret leaks) by proving the vulnerability path without modifying or destroying application state, dropping database tables, or performing denial-of-service. Built-in rate limiting and an instant kill switch protect your infrastructure.
Can I use Xalgorix reports for SOC 2, ISO 27001, or vendor security reviews?
Yes. Xalgorix produces audit-grade executive and technical PDF reports complete with timestamps, tested endpoints, OWASP/CWE taxonomy, methodology disclosures, and proof-of-concept evidence. Many founders and engineering teams use Xalgorix to satisfy annual pentest requirements and clear vendor security questionnaires (VSQs) with enterprise procurement.
Can I scan a target I don't own?
No. You may only scan targets you own or have explicit written permission to test, as set out in our Acceptable Use Policy. Securing that authorization is your responsibility. Every scan is recorded against the account that launched it, and we suspend accounts that violate the AUP.

Need a private deployment?

Tell us about your residency, identity, and infrastructure requirements. We will confirm what we can deliver and quote the scope before you commit.

Talk to salesRead the docs