Tool profile
Hadrian: cost, fit and limits
Hadrian is an offensive security platform made by Hadrian Security B.V. in Amsterdam that pairs continuous external exposure mapping with agentic AI pentesting to confirm which exposures an attacker could exploit. It is sold as Atlas and Nova.
What to know first
Hadrian sells two products that can be bought together. Atlas maps subsidiaries, domains, IPs, certificates and cloud hosts continuously and is priced by asset count on request. Nova runs on-demand agentic pentests of web applications from EUR 1,250 per test excluding VAT. A SOC 2 Type 2 badge is displayed, and findings go to a long list of ticketing, SIEM and SOAR tools.
Hadrian at a glance
| Maker | Hadrian Security B.V., Netherlands |
|---|---|
| Free plan | No |
| Entry price | From €1,250 per test (Nova), excluding VAT |
| API access | No |
| Category | Best AI Attack Surface Management Software in 2026, rank 2 of 10 |
| Website | hadrian.io |
Who Hadrian is best for
Teams drowning in unverified findings
Hadrian says its agents prove how far an exposure goes before it is reported, which suits teams that must reduce triage load rather than add more alerts.
European regulated firms
Nova reports map to SOC 2, ISO 27001 and NIS2, and framework pages cover DORA, which helps financial and critical-sector teams collect audit evidence.
Companies buying pentests per test
A starting price of EUR 1,250 per test with bundles available lets a buyer try agentic testing on one application before signing an Atlas contract.
Hadrian plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Atlas | Quote, based on total asset count | Continuous external exposure management that maps the attack surface, validates exposures and chains vulnerabilities, re-testing on each change; add-ons cover M&A assessment and infostealer leaks. |
| Nova | From EUR 1,250 per test excluding VAT, bundles available | On-demand agentic pentesting with full reporting, a view of the AI's reasoning, tests and evidence, and results mapped to SOC 2, ISO 27001 and NIS2. |
| Atlas plus Nova | Not shown | The combined offensive security suite, described as Atlas finding the exposure and Nova proving how far it goes; no separate price is listed. |
Checked October 2026.
What Hadrian does
- Atlas discovery
- Atlas continuously maps subsidiaries, domains, subdomains, IPs, certificates and cloud hosts, and enriches each asset with context so findings can be tied to a business unit.
- Nova agentic pentests
- Nova agents sign in as each role, map routes, learn the application's business logic and chain steps into impact. The vendor says they work within the scope set and without changing records.
- Emerging threat response
- When a new CVE is published, the platform checks the customer's exposure to it, so the team learns quickly whether a headline vulnerability applies to its assets.
- Remediation validation
- After a fix, Hadrian retests the finding to confirm it no longer works, which closes tickets with evidence instead of an engineer's assertion. The retest result is attached to the original finding.
- Audit evidence
- Framework pages cover DORA, NIS2, ISO 27001, SOC 2 and MITRE ATT&CK, and Nova reports map findings to those frameworks. This helps teams that answer regulator questions about testing.
How Hadrian handles your data
The privacy statement names Hadrian Security B.V., Leidseplein 1, Amsterdam, commercial register number 83587691. It does not say where customer data is hosted and refers to a secure server without naming a location or provider. It names no subprocessors, describes categories of recipients and says data processing agreements are signed with them. Standard Contractual Clauses are used for suppliers outside the EEA. The statement does not say whether data is used to train AI models. The site shows a SOC 2 Type 2 badge, and Nova has separate terms we did not read.
Where Hadrian falls short in practice
- Atlas has no public price. Asset-based pricing for the discovery product requires a demo, and the combined suite shows no price at all, so a budget needs a sales conversation.
- Hosting is undisclosed. Neither the privacy statement nor the home page names a region or provider for customer scan data, a gap for buyers with data residency rules.
- Pentest scope is not stated. The pricing page does not state what one Nova test covers, such as application size or number of roles, so confirm scope before relying on the per-test price.
Works with
Alternatives to Hadrian
Hadrian: common questions
What is the difference between Atlas and Nova?
Atlas is the breadth product, a continuous map of the external attack surface that validates exposures. Nova is the depth product, an on-demand agentic pentest of web applications. They can be bought separately or as an offensive security suite. Ask for a combined quote if you need both.
How much does a Nova pentest cost?
The pricing page says from EUR 1,250 per test excluding VAT, with bundles available. It does not list bundle prices or the test scope, so ask for a scoped quote against your application. Bundles are mentioned but not priced, so ask what a typical application costs to test in full.
Does Hadrian have an API?
The integrations page calls Hadrian API-first and says the API connects with almost any existing tooling. It does not publish documentation, authentication details or rate limits, so those need confirming through a demo. Teams that script their own tooling should request the specification early in the evaluation.
Which security tools does Hadrian integrate with?
Named integrations include Splunk, Microsoft Sentinel, Google Security Operations, Cortex XSOAR and Tines on the SIEM and SOAR side, plus SentinelOne, CrowdStrike Falcon and Microsoft Defender, and ticketing in Jira and ServiceNow. Check which of them your team uses before you commit.
Is Hadrian a European company?
The privacy statement names Hadrian Security B.V. with an Amsterdam address, so the legal entity is Dutch. The pages we read do not say where customer data is stored, so confirm that separately. Ask about hosting before you sign. Dutch entities still use suppliers outside the EEA.