SelfSecOne plan, everything in it. Unlimited targets and scans, hosted AI, managed out-of-band testing and five seats — nothing is held back for a higher tier, because there is no higher tier.
The whole scanner at one flat price: unlimited targets and scans, hosted AI, managed OAST and five seats.
SelfSec is pre-release: nothing is charged today and this is the launch price. Prices are in USD and billed monthly.
A sourced view of the product models, public buying paths and workflows. This is not a detection benchmark.
| Capability | SelfSec DAST | Burp Suite Professional | Invicti |
|---|---|---|---|
| Product model | Pre-release local agent for Windows and LinuxSource | Desktop pentesting toolkitPortSwigger product page (opens in a new tab) | Enterprise AppSec platformInvicti product page (opens in a new tab) |
| Published buying basis | Flat plans, published pricesSource | $499 per user, per yearPortSwigger price (opens in a new tab) | Custom quoteInvicti pricing (opens in a new tab) |
| Deployment | Core scan processing runs locallySource | Local desktop applicationPortSwigger features (opens in a new tab) | Cloud or on-premises optionsInvicti pricing (opens in a new tab) |
| Primary workflow | Automated DAST with report and CI outputsSource | Automation plus hands-on manual testingPortSwigger product page (opens in a new tab) | Enterprise automation and CI/CDInvicti pricing (opens in a new tab) |
| Finding validation | Four-stage lifecycle; Confirmed requires independent evidenceSource | Scanner plus manual testing toolkitPortSwigger features (opens in a new tab) | Proof-Based ScanningInvicti pricing (opens in a new tab) |
| Purchase path | Join the launch listSource | Purchase at listed pricePortSwigger product page (opens in a new tab) | Start a quoteInvicti pricing (opens in a new tab) |
This is a product-model comparison, not an independent detection benchmark. Vendor offerings and prices can change; follow each source before purchasing. Verified July 25, 2026.
It is a different product model, not a claim to out-detect them. Burp Professional is a hands-on toolkit priced per user, per year; Invicti is an enterprise platform bought through a quote. SelfSec is automated, self-hosted and flat-priced, and its classical engine has to confirm a finding before it is reported. The comparison above sets each difference against the vendor's own published page — it compares product models and buying paths, not detection results.
Your AI key and scan data stay local — you bring your own OpenAI or Anthropic key, or run AI fully offline with Ollama. Core scan processing stays on the scanner host: requests, responses and the findings database are never uploaded. Activation signs in with your account and sends only a machine ID, product ID and app version; device diagnostics and managed OOB confirmation are separate features that stay off unless you switch them on, and managed OOB reports the target URL with its correlation fields.
Your scans run on 127.0.0.1 and your findings stay local; this site handles your account, subscription and activation. The optional remote flows are not hidden behind a general telemetry label — device diagnostics and out-of-band interaction reporting are separate features with separate controls, and each stays off until you switch it on.
SelfSec is a local agent that runs on a Windows or Linux host you already control. You point it at a target you are authorized to test — a web application, an Android application or a Windows desktop application — and watch findings stream into a live dashboard. Host sizing and supported operating-system versions are published together with each installer.
Windows and Linux. Both are built and tested today and both ship at first release — an installer for Windows and a self-extracting package for Linux, each with the browser engine bundled so there is nothing else to install. macOS is not supported and no other host platform is announced. One exception is worth stating plainly: scanning a Windows desktop application drives the Windows UI stack, so that target type needs a Windows host. Web and Android targets behave the same from either platform.
Android, yes; iOS is not supported. You give it an APK or an installed package, and the scanner drives the app on an emulator or a connected device while a local capture proxy turns the app's own requests into scan targets for the same engine that tests a website. It is not a one-click path: the Android SDK platform tools have to be on the scanner host, and intercepting HTTPS needs either a rooted device or the APK repackaging option. When neither is available the scan still runs and reports that its HTTPS coverage degraded, rather than quietly covering less.
An account, and nothing more. Registering gives you a profile, support tickets and the newsletter — it does not unlock the scanner. The SelfSec app signs in with that account and refuses to run without an active plan, so there is no free usage tier to evaluate on. There is a single plan, and it carries the full 21 vulnerability and 10 passive modules, hosted AI, aggressive evasion, managed out-of-band testing and unlimited scan volume. Nothing is held back for a higher tier, because there is no higher tier.
The plan includes five seats under one flat price, with no per-seat tax as your team grows. A seat is a machine running the SelfSec app; release one from your dashboard and it is free for someone else.
Sign in to the SelfSec app with the same account you use here — there is no key to generate or paste. The app reports your active plan and limits, and you can release any machine from your dashboard.
Nothing is charged during pre-release. The prices listed are the launch prices, checkout runs against a simulated provider so the account and subscription flow can be exercised end to end, and a real payment provider slots in behind the same flow before public availability opens.
Yes, and they stay separate subscriptions on the same account. SelfSec DAST and SelfSec WAF are billed independently, start and end independently, and cancelling one from the dashboard leaves the other running.
Partly today, and we would rather be exact than sell you a step that does not exist. Scans and report exports are driven by a local HTTP API on 127.0.0.1, so a pipeline job on the scanner host can start a scan and pull the result. Reports export as SARIF 2.1.0, which GitHub code scanning ingests directly, alongside HTML, JSON, Markdown and a MITRE ATT&CK Navigator layer. What is not shipping yet is a packaged command-line runner with a build-failing exit code — it is on the roadmap and this answer will change when it lands.