Secure your code, cloud and attack surface — in one platform

Pricing is per target, and there are three kinds. An infrastructure host — one IP, hostname or subdomain — is $4 a month, with 3 included on Basic and 8 on Advanced. A web application, meaning one running app tested from the outside, is $45, with 1 included and 2 on Advanced. A repository for code scanning is $9, with 10 included and 20 on Advanced. Discovery is free and maps your whole footprint: a licence is used only when you put a host under monitoring, so the hosts you dismiss cost nothing. Rescans are unlimited, users are unlimited, and read-only seats for auditors are free.

You can, and running a scanner is the easy part — the engine isn't the product. Running a scanner is a Tuesday afternoon. Knowing that a new staging.admin appeared last week, that a certificate expired 41 days ago, and that a host you'd forgotten was quietly answering the whole time — that's a system, not a scan. Topscan keeps the inventory, watches it continuously, tracks what you accepted versus fixed, and holds the evidence an auditor asks for.

Add a domain while you sign up and discovery answers within five to ten minutes — that is your first map of what faces the internet, before anything is scanned. Scanning comes after you confirm what to monitor: a fast check finishes in five to fifteen minutes, a full infrastructure audit in thirty to ninety, and a deep web application scan can run up to a few hours. Those are typical times, not guarantees — the real duration depends on the target.

No for external scanning — you add a domain or IP and it starts. SAST connects to your repository, CI/CD gating goes through a webhook, and AWS connects with keys you issue to discover EC2 and Route 53. Nothing runs on your servers.

A pentest is a deep look on one day. This is a shallow look every day. A pentest tells you how far someone could get; continuous monitoring tells you what changed since Friday. Most incidents start with something that appeared after the last release.

That's what most teams use it for. Auditors ask for evidence of regular scanning and an inventory of what's exposed — both are produced automatically: scan history with downloadable reports, and an exportable asset inventory. Auditor seats are free and read-only.

Every finding ships with the evidence that produced it — hostname, status code, response banner, certificate date — so you can verify it in a second. Mark it as a false positive or snooze it, and it stops resurfacing. We'd rather report less and be checkable than report more.

You authorise scanning when you add a target and confirm ownership. Default discovery uses public registries, DNS and a single ordinary HTTP request. Port scanning and active vulnerability templates run only on targets you've explicitly confirmed — that boundary is deliberate, because in some jurisdictions an unauthorised port scan is a criminal matter.

Customer data is stored in the Hetzner cloud in Ashburn, Virginia, US. None of the developers have access to the production environment; only the Head of DevOps has access, and all his actions are logged. No customer data leaves our infrastructure or is transmitted to third-party systems (such as third-party AI services); all operations take place within a closed environment. We are currently undergoing a SOC 2 audit and monitoring our processes via Drata. In the event of account deletion, all data will be permanently removed from our servers within 180 days. Your source code is cloned for the scan and the clone is deleted afterwards — only the affected lines are kept.