how we compare
where recon.sh fits.
a traditional pentest and a bug bounty program both have their place. here is how we compare on price, speed, and what you actually get - and where you still want a human.
| recon.sh | traditional pentest | bug bounty | |
|---|---|---|---|
| price | 49 to 499 creditsper finding, plus 5 credits a scan | $5k to $30kper engagement | ~$20k+per year in fees |
| same-day results | included | not offered | partial |
| self-serve signup | included | not offered | not offered |
| no day rate, no annual fee | included | not offered | not offered |
| external attack surface | included | included | included |
| expert knowledge | included | included | included |
| verified findings | included | included | included |
| internal + source review | not offered | included | not offered |
| compliance letterhead | not offered | included | not offered |
recon.sh is paid with credits. 1 credit = $1. price ranges are typical figures from public 2025 to 2026 pentest and bug-bounty pricing guides, for a single web application. your numbers will vary with scope.
the price is low. the test is not.
recon.sh points the best available models at your app and drives them through a real red-team methodology - recon, enumeration, manual exploitation, business-logic abuse, chaining - then reproduces every finding against your live target before it ships. that is senior-tester work, not a scanner pass. it costs 49 to 499 credits a finding because the testing scales without a day rate, not because it cuts corners. internal networks, source review, and the social-engineering an attacker can't reach still want a human, and we tell you when - but on everything exposed to the internet, this is the sharpest test you can buy.
it isn't a model with a prompt. it's a methodology.
recon.sh runs a structured red-team playbook - recon, enumeration, manual testing, business-logic abuse, chaining, reporting - over a curated toolchain, not a single question to a chatbot. it reasons about what your app is supposed to do, then tries to break that, the way a tester would.
every finding is reproduced before it reaches you.
the engine re-runs each finding against your live target and ships the request, the response, and a working repro in the evidence package. if a finding can't be reproduced from that evidence, it isn't a finding - its credits come back. that verification step is the whole product.
what we don't replace
we own the external layer so the expensive hours go where they matter.
you still want a traditional pentest for the internal network, source review, social engineering, host hardening, and the signed letterhead an auditor wants. you still want a bug bounty program for continuous coverage and a crowd's creativity over time. recon.sh covers everything an attacker can reach from the internet and proves every finding - so the expensive human hours go to the internal, creative work they do best, not to an external surface a machine now tests end to end.
see what an attacker finds first. before they do.
or see a real sample report5 credits to scan. pay for the findings you unlock. credits back if one doesn't reproduce.