Tool profile
ProjectDiscovery: cost, fit and limits
ProjectDiscovery is a security company based in the United States that maintains open source reconnaissance tools such as Nuclei and sells Neo, an AI agent platform for pentesting, attack surface discovery and vulnerability validation. It is sold per seat.
What to know first
ProjectDiscovery sells Neo per seat, with a free tier, a pay-as-you-go plan at $200 per seat per month and a custom Enterprise plan. Usage is metered through a weekly allowance that resets every seven days. The vendor's site states SOC 2 Type II, SAML and OIDC single sign-on, and zero data retention. Buyers who know Nuclei will find a familiar community behind the commercial agent.
ProjectDiscovery at a glance
| Maker | ProjectDiscovery, Inc., United States |
|---|---|
| Free plan | Yes |
| Entry price | $200 per seat per month, free tier available |
| API access | Yes |
| Category | Best AI Attack Surface Management Software in 2026, rank 2 of 10 |
| Website | projectdiscovery.io |
Who ProjectDiscovery is best for
Pentesters and red teams
Neo signs in through SSO, TOTP MFA, VPN or SSH, tests each user role and reports findings with proof, which saves a tester the replay work.
Teams already running Nuclei
The commercial platform builds on the open source tools the team may already use, such as Nuclei, Subfinder, HTTPx and Naabu.
Regulated buyers wanting isolation
Enterprise offers a dedicated VPC or on-premises deployment and private network access, which matters for companies that cannot send scan data to a shared sandbox.
ProjectDiscovery plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Free | $0, no credit card | 1 seat, a limited one-time usage allowance, standard open-weight models, shared sandbox, US-hosted with zero data retention. |
| Pay as you go | $200 per seat per month or $2,100 per seat per year | Up to 5 seats, a weekly allowance with top-ups, standard and frontier models, a more powerful sandbox and shared memory. |
| Higher allowances | $400 or $800 per seat per month | Pay as you go at 2x or 5x the base weekly allowance, with the same seat limit and features. |
| Enterprise | Custom | Unlimited seats, custom usage, dedicated autoscaling sandbox, SSO and SAML, bring-your-own model key, on-premises or VPC deployment and a support SLA. |
Checked October 2026.
What ProjectDiscovery does
- Autonomous pentesting
- Neo agents test applications and APIs, replay findings against live targets and report only those with proof. The site gives an example of a race condition in coupon redemption.
- Attack surface discovery
- Neo inventories external, internal and code assets and links them in one context view, so a finding is read alongside the asset and its owner.
- Remediation workflow
- The agent opens pull requests with fixes and regression tests, and retests open issues on each deploy. It connects to PR workflows, Jira and Slack.
- Model choice
- Customers can pick among several frontier models or bring their own API key. The Free plan uses standard open-weight models only. Model access differs by plan.
- Scope guardrails and logs
- Runs stay inside defined boundaries such as staging. Agent actions are logged and can be exported to a SIEM such as Splunk, per the product page.
How ProjectDiscovery handles your data
The pricing page states that the Free plan is US-hosted with zero data retention, Pay as you go uses the standard deployment, and Enterprise can run on-premises, in a dedicated VPC or over private network access. The home page claims SOC 2 Type II, SAML and OIDC single sign-on, zero data retention and managed cloud or dedicated VPC on Azure, AWS or Google Cloud, with static egress IPs for allowlisting. A subprocessor list and a statement on model training were not checked on the pages we read.
Where ProjectDiscovery falls short in practice
- Weekly allowances can pause work. Usage depends on model reasoning and infrastructure, and running tasks pause when the allowance is used up. Unused allowance does not roll over, so spiky pentest weeks can exhaust a seat early.
- Not an asset inventory first. Attack surface discovery is one capability inside a pentesting and triage product. A team that wants ownership tagging and a long-running inventory should compare it against dedicated tools.
- Seat cap on self-serve. Pay as you go stops at five seats. Larger teams need the Enterprise plan, whose price is not published. A procurement team should plan for that jump.
Works with
Alternatives to ProjectDiscovery
ProjectDiscovery: common questions
Is Neo free to try?
Yes. The Free plan costs $0, needs no credit card, includes one seat and gives a limited one-time allowance on a shared sandbox with open-weight models. It is a way to test the agent, not to run continuous coverage. Expect to move to Pay as you go for real work.
How does the weekly allowance work?
Allowances reset every seven days from the subscription start date and unused amounts do not roll over. When a task exhausts the allowance, running work pauses until you buy a top-up or the reset arrives. Higher tiers at $400 and $800 per seat give two or five times the base weekly allowance, which is the lever for heavy users.
Can ProjectDiscovery run on our own infrastructure?
Enterprise lists on-premises, dedicated VPC or private network access deployment, and the home page mentions dedicated VPC on Azure, AWS or Google Cloud with static egress IPs. The Free and Pay as you go plans use the vendor's cloud. Ask which option your security team accepts.
Does Neo have a SOC 2 report?
The home page states SOC 2 Type II compliance. The pages we read do not describe the scope or the auditor, so request the report from the vendor if your review process requires it. Ask whether the report is available under NDA and which entities it covers.
Which models does Neo use?
The Free plan uses standard open-weight models, Pay as you go adds frontier models, and Enterprise allows frontier models or your own key. The pages we read do not name the specific model vendors. Ask which providers handle your prompts if that matters to your review.