Pay for what you protect.
Redthread is licensed by module, so you can start with the one you need and add the rest later. Each is priced on the unit that matches its job — your estate, your scans, your engagements, your agent identities. Tell us what you're working with and we'll put a quote together around it.
Rolling Redthread out across a large organisation? Read the enterprise overview →
AI Risk Assessment & PlatformEstate · free to start
The estate assessment is free: every AI you run and which risks are real, across your cloud, agents, website and GitHub (for shadow-AI discovery). The platform keeps it current — one graph of your whole AI and cloud estate: cloud accounts, repositories, agents, models and services. Cloud and infrastructure posture, shadow-AI discovery, identity and access paths, and continuous re-testing in CI/CD — each finding ranked by whether it can actually be reached.
Redthread PentestPer scan
Prove the riskiest paths the assessment finds: autonomous testing of AI applications and agents, the report a pentest firm would hand you. Every reported finding comes with a working proof-of-exploit you can reproduce, mapped to the OWASP LLM Top 10 and MITRE ATLAS. Findings that can't be proven are shown as unproven, not inflated.
For Pentesters & Security FirmsPer engagement
Redthread under your brand. Your analysts direct and validate each run; you sign and ship a white-label report with a reproducible PoC for every finding. You keep the client relationship and the engagement revenue.
Agentic Trust & Protection PlatformPer identity
Cryptographic identity and signed attestation for AI agents, including third-party MCP servers. Not a claim about what an agent is allowed to do — a verifiable record of what it just did. Available with the platform or on its own.
Reports & compliance evidenceAdd-on
Audit-ready evidence packs: findings, proof, remediation and re-test history, exported for SOC 2, ISO 27001 and your customers' security reviews. The Free plan includes one compliance report for one reporting standard (the first you choose is final); the attestation letter and the full report are on paid plans.
Discovery is free. Connect your estate and see the full graph, shadow AI and posture before any conversation about price — no card. Run a free estate scan →
| Free | Paid plans (quoted to your estate) | |
|---|---|---|
| Estate scan | Yes: read-only cloud (AWS, Azure, Google Cloud, Oracle), GitHub for shadow-AI discovery, website discovery | Yes |
| Risk graph, attack paths, AI gaps, shadow-AI inventory, cloud and data posture | Yes | Yes |
| Pentest scans | One black-box scan of your website, for life | Monthly scans that grow with your estate, including source-code (white-box) scans |
| Reports | One compliance report, for one reporting standard | Every standard, the full pentest report and the Letter of Attestation |
| Agent identities | Up to 10, registered in your Redthread workspace | 50 and more, by plan |
| Working exploit proof and auto-fix pull requests | No | Yes |
| CI and pull-request gate, scheduled scans, network pentest | No | Yes, by plan |
| Endpoint and runtime sensors, SSO, SCIM and audit log | No | Yes, by plan |