Human-readable pricing

To get started, all you need is a target and a set of credentials. Heist can test web applications and APIs. You will be asked to verify your domains during onboarding.

For most companies, yes. Heist needs a dedicated workspace that does not contain or affect real customer data. Where this is not possible in production, most companies can run Heist in staging or testing environments.

Two examples of unsafe production environments:

1. An internal company admin dashboard with a shared workspace for all employees.
2. Marketplace and social applications where users post and interact with other users' content in public.

If you are unsure, start in a testing environment.

IP address

34.88.253.84

Header

X-Heist-Agent: heist/1.0

Region

Finland (europe-north1)

Use the IP address or header to identify Heist in your logs and allow its traffic through your firewall or WAF. We can also set a requests-per-second limit for your workspace to match your infrastructure.

The Standard plan includes 200 routes for €350 per month. Each additional route costs €1.50.

Web app and API routes are counted separately, so /users and /api/users count as two routes. Multiple HTTP methods on the same API URL pattern count as one route. Running exploration is free.

You choose which apps to include and get a price overview before testing starts. Most of our customers fit within the base plan.

Heist runs continuously, keeps the scope up to date as your application changes, and ensures that every route is tested at least once every month. Retesting is free and unlimited, and issues closed in your ticket system can be retested automatically through our integrations.

For most companies, yes. Some regulated organizations still require human led or threat led testing, such as TIBER-EU testing under DORA. For them, Heist is a strong complement that provides continuous testing between those assessments. Heist can also provide human attestation when you need it.

Heist tests your running application instead of judging source code in isolation. OWASP ASVS guides what we test, and a separate verification system reproduces findings before they are reported. Each run adds application context that deepens future coverage. To avoid incentives to generate noise, we do not guarantee findings of a certain severity.

Customers have used Heist reports for SOC 2 audits. Every endpoint is tested against the recognized OWASP ASVS 5.0 framework, with an audit trail that records every test, network event, and outcome. Heist can provide human attestation if needed.

Heist uses the access you provide to test your application. If you add Heist to a workspace containing customer data, Heist will be exposed to customer data. We process data in the EU, while some model inference may be processed globally. We only use models with zero data retention policies. Our data processing agreement explains how we handle personal data and which service providers we use.