Tool profile
runZero: cost, fit and limits
runZero is an asset discovery and exposure management platform made by runZero, Inc. that finds and fingerprints IT, OT and IoT devices on internal and external networks for security and IT operations teams. It also ships a free tier.
What to know first
runZero starts from an inventory problem. Its scanner and passive discovery build a list of devices, then layer risk context on top. A free Community Edition handles 100 or fewer assets, and the Platform starts at $5,000 on contract terms. Version 5.1 added AI workflows for natural-language searches, reports and custom integrations. The pricing page lists compliance frameworks it supports, yet it names no certification or customer-data region.
runZero at a glance
| Maker | runZero, Inc., United States |
|---|---|
| Free plan | Yes |
| Entry price | Free Community Edition; Platform starts at $5,000 |
| API access | Yes |
| Category | Best AI Attack Surface Management Software in 2026, rank 2 of 10 |
| Website | runzero.com |
Who runZero is best for
Mixed IT and OT estates
The vendor lists IT, OT and IoT discovery and a native Dragos integration, which suits plants and hospitals where unmanaged devices outnumber servers.
Small labs and researchers
The free Community Edition allows 100 assets and three concurrent scans, enough for a home lab, a small office or a proof of concept before a purchase.
Teams that script their own workflows
Export, Organization and Account APIs, a command-line scanner and a custom integration SDK are listed, so an engineer can feed asset data into existing tools.
runZero plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Community Edition | Free | Up to 100 assets, one organization, 10 recurring tasks, 30 days of data retention and 3 concurrent scans, aimed at individuals, small businesses and researchers. |
| runZero Platform | Starts at $5,000 | Contract-based asset limit, unlimited organizations and recurring tasks, three years of retention and 15 concurrent scans, plus no scan range limit. |
| Free trial | Free for 21 days | A full-featured trial of the Platform, described on the pricing page as the way to test before buying. |
| Self-hosted console | Platform license plus runZero Care | Optional self-hosted deployment of the console for teams that cannot use the vendor-hosted SaaS console. |
Checked November 2026.
What runZero does
- Active and passive discovery
- Explorers scan networks and listen passively to build an asset list that covers managed and unmanaged devices. Explorers can be self-hosted for internal scanning or runZero-hosted for external scanning on the Platform.
- Natural-language search
- Version 5.1 AI workflows turn plain-language questions into queries, dashboards and compliance reports. The vendor describes this as translating requests into the query builder syntax so analysts do not hand-write queries.
- AI-assisted integrations
- Users can pick an LLM and describe a data connector in a prompt. The vendor says the code runs in sandboxed execution environments, which limits what a generated connector can reach.
- Attack path and risk context
- Risk dashboards, contextual scoring and attack path mapping rank assets by exposure and by how reachable they are from the internet or from other segments.
- Identity and access controls
- SSO with SAML2, WebAuthn hardware key MFA, role-based access control and SSO group mappings are listed among admin and security features. These controls are listed on the pricing page for enterprise rollouts.
How runZero handles your data
The privacy notice names runZero, Inc., headquartered in Austin, Texas, and says personal information may be stored in the customer's region, the United States or other countries where providers operate, with standard contractual clauses for transfers. It lists no subprocessor names beyond Google Analytics and gives no hosting provider. Personal information is kept only as long as necessary and then deleted or anonymized. The notice makes no statement on AI model training, so the vendor's policy was not checked for this. Platform data retention is three years, and Community keeps 30 days.
Where runZero falls short in practice
- Community scope is small. The free edition caps assets at 100, scan ranges at 8,192 IPs and packet rate at 5,000 per second. A single class B network exceeds the range limit, so real evaluation of larger sites needs the trial.
- Platform pricing is a floor. The page says the Platform starts at $5,000 and ties the asset limit to the contract. A buyer cannot see how the price grows with asset count without a quote.
- Per-plan feature mapping is unclear. The pricing page lists many discovery, automation and security features, but the text does not show which belong to Community and which to Platform, so confirm SSO and API access before relying on the free tier.
Works with
Alternatives to runZero
runZero: common questions
Can runZero scan internal networks as well as the internet side?
Yes. Explorers run inside your network for internal scans, and runZero-hosted explorers handle external scanning on the Platform. The product covers both views in one inventory, which is unusual among the external-focused tools in this category. Ask which explorer type your scope needs before you buy.
How long does runZero keep data?
The Community Edition keeps 30 days of data, and the Platform keeps three years. Projects are unlimited on the Platform, are read-only after 30 days and retain data for 90 days, according to the pricing page comparison. Anything older than the window needs an export before it ages out.
Is there a self-hosted version of runZero?
Yes, the console can be self-hosted, but it needs a Platform license plus the runZero Care support package. The default is a SaaS console run by the vendor, and explorers can be self-hosted either way. Teams that need on-premises storage should ask for the Care package terms.
What do runZero's AI workflows do?
Version 5.1 adds natural-language searches, AI-assisted dashboards and reports, autonomous discovery and AI-assisted custom integrations. The integrations use LLMs the user selects and run in sandboxed environments, per the pricing page. The page does not say which model vendors are supported, so confirm that with the vendor before planning an integration project.
Does runZero hold a SOC 2 or ISO 27001 certificate?
The pricing and privacy pages we opened state no certification. They list compliance frameworks the product supports, such as NIS2, DORA and PCI DSS, which is different from a certification, so ask the vendor for audit reports. A report under NDA is the usual route.