How is the price calculated?

The price of blacklens.io follows scope: the number of external and internal assets, of users for dark web monitoring and IAM and of suppliers in supply chain monitoring (5 per workspace included, more licensed like Sentry assets), and optionally the test cadence for penetration testing. Every licence includes every module, from attack surface management and early warning to AI analysis, reports, integrations, REST API and mobile app. You pay for scope, not for features. You get the price for your scope through the price indication, usually within one business day.

How are assets counted?

An external asset is any object in your scope: a domain, an IP address, a cloud service or a server. Subnets are expanded to the addresses they contain and counted accordingly. Assets not seen for 7 days drop out of the inventory automatically. Internally, every host checked by the Sentry scanner counts.

What does Sentry cost?

5 Sentry assets are included in every workspace, and the scanner appliance itself (VM or Docker) is free and can be deployed as often as you like. Beyond that, licensing is per internal asset. You get the exact price for your number of internal hosts through the price indication.

What does supply chain monitoring cost?

5 suppliers are included in every workspace, with grade, findings, alerts and reports. Like Sentry assets, suppliers are a licensed count of their own: if you need more, your blacklens.io partner or our sales team extends the supplier licence of your workspace. The 14-day trial includes supplier ratings as well. You get the exact price for your number of suppliers through the price indication.

Which users count for dark web monitoring?

For dark web monitoring and IAM analysis, blacklens.io counts active users with a mailbox. This number determines which identities are watched in stealer logs and combolists as well as in your directories. Compromised accounts are automatically classified as employee or customer. You can adjust the number of users at any time during the term.

What does penetration testing cost?

Penetration testing as a service is optional and licensed separately as a pentest licence, based on test targets and test cadence. OSCP-certified pentesters test inside the same platform on the cadence you choose, from weekly to yearly. Their findings are marked as verified, backed by evidence and retested after remediation. You get the price for your scope through the price indication.

Are there discounts for MSSPs and partners?

Yes. Value added resellers and managed security service providers get dedicated partner terms, tiered by volume. For MSSPs, blacklens.io offers multi-tenancy with separate workspaces, a portfolio dashboard across all customers, custom roles, global alert recipients and white label. See the partner page for details or ask in the partner call.

Can I cancel monthly?

We offer annual contracts with flexible scaling: you can adjust assets and users up or down at any time during the term, for example when new sites or domains are added. Term and cancellation details are part of the quote. The 14-day trial ends automatically without cancellation and at no cost.

Can I try blacklens.io before deciding?

Yes. The trial runs for 14 days with the full feature set for your domain, no credit card, and your workspace is ready within 24 hours. You see real results for your attack surface before you choose a configuration. On request we show you the platform in a demo first.

Pricing

Every module in one licence, priced by scope

You pay for the scope you monitor: assets, users and suppliers. No feature tiers, no add-on packs.

Try free for 14 days Request a price indication

Full feature set, no credit card, workspace within 24 hours.

Three example configurations

For orientation; any other combination works too. The price indication gives you the price for your scope.

Starter

Entry

One domain and a manageable infrastructure.

Price on request

Try free for 14 days

Scope

1 domain
up to 25 external assets
up to 50 users
5 Sentry assets and 5 suppliers included

Included

Attack surface management
Vulnerability management
Dark web monitoring
Early warning and AI analysis

Business

Mid-sized companies with several domains, sites and an internal network.

Price on request

Request a price indication

Scope

multiple domains
up to 150 external assets
up to 250 users
Sentry for internal scans and AD

Included

Everything in Starter
Sentry scanner as VM or Docker
Dedicated contact on request
Optional: penetration testing

Enterprise / MSSP

Corporations, groups and service providers with several tenants.

Price on request

Talk to sales

Scope

unlimited assets and users
tenants and workspaces
portfolio dashboard
optional PTaaS on your schedule

Included

Everything in Business
Multi-tenancy and white label
Custom roles, global alert recipients
Dedicated contact and onboarding

Annual contracts with flexible scaling. Price, term and details come with the quote.

How licensing works

The price follows scope, not features. You can adjust external assets, Sentry assets and users at any time.

External assets
Domains, IPs, cloud services and servers in scope. Subnets count per address.
Sentry assets
Internal servers, clients, OT and Active Directory. 5 included in every workspace.
Users
Active users with a mailbox, for dark web monitoring and IAM analysis.
Suppliers
Supply chain monitoring: 5 per workspace included, more licensed like Sentry assets.
Penetration testing
Optional: OSCP-certified pentesters on your schedule, from weekly to yearly, retests included.

Licence scopeExample

External assets10

beispiel-gmbh.atDomain1 asset

198.51.100.0/29Subnet, expanded to addresses8 assets

203.0.113.24Cloud service, AWS1 asset

Sentry assets5includedServers, clients, AD

Suppliers5includedSupply chain monitoring

Users50Dark web monitoring, IAM

All modules included

Request a price indication

Put your scope together. You receive the quote by email, usually within one business day.

External assets

Domains, IPs, subnets, cloud services and servers

Internal assets (Sentry)

Hosts behind the firewall, 5 per workspace included

Users / mailboxes

For dark web monitoring and IAM analysis

Suppliers (supply chain monitoring)

One domain per supplier, a licensed count like Sentry, 5 per workspace included

Modules

The amount comes with the quote, because volume, term and partner model affect it.

Your configuration

25 external assets
5 internal assets (Sentry)
50 users
5 suppliers

Modules: Attack surface management, Vulnerability management, Dark web monitoring, Sentry (internal scans), Supply chain monitoring

Included in every licence

No feature tiers: configurations differ in scope, not in features.

Integrationsalerts, tickets, cloud

Jira
Microsoft Teams
Slack
GitHub
GitLab
Elastic
AWS
Microsoft Azure
Google Cloud
Cloudflare
Hetzner
Webhook

REST API250+ endpoints

Integrations and REST API

Jira, ServiceNow, Teams, Slack, GitHub, GitLab, webhook and Microsoft Sentinel, plus API keys.

AI explanationself-hosted LLM

CVE-2024-21762vpn.beispiel-gmbh.atKEVCritical

Root cause: Outdated FortiOS version on the SSL VPN gateway.
Impact: Attackers can execute code without logging in.
Remediation: Update to FortiOS 7.0.14 or later.

AI analysis

Root cause, impact and remediation explained, by a self-hosted LLM without external AI providers.

Reportsscheduled by email

PDFExecutive reportWeekly, Monday 07:00

PDFVulnerability reportMonthly

PDFPentest reportAfter every test

Management, head of IT

Reports and compliance

Eight PDF report types, on demand or scheduled by email, CSV export from every list.

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Dark web monitoring

Compromised identities and devices, checked daily, leaked accounts matched against Microsoft 365 and AD.

Where your data is processed

PlatformDACH data centres, ISO 27001, SOC 2

Scan infrastructureAustria, Germany, Switzerland

AI analysisSelf-hosted LLM, no external providers

Fixed source IP rangesAllow in firewall, WAF and IDS

Hosted in the DACH region

Platform in ISO 27001 and SOC 2 certified data centres, our own scanners in Austria, Germany and Switzerland.

Visuals show sample data.

What customers say

Manufacturing, retail, software and IT service providers from the DACH region.

“blacklens.io is the ideal complement to our internal IT security measures. It continuously checks our externally reachable systems, tells us when action is needed and is an important building block of our cyber defence.”

Christian Mondl, Smarter Ecommerce GmbH

“We were looking for a tool for automated penetration tests. What we found was a platform that lets us identify far more than potential entry points. Real added value for our SecOps.”

Christian Rohrmoser, Mayr Schulmöbel GmbH

“blacklens.io helps us meet the state of the art by flagging vulnerabilities on externally available services very quickly. Together with dark web monitoring, visibility of IT and information security risks improved significantly.”

IT department, Hauser GmbH

Configurations compared

All run on the same platform. Differences come from scope and operating model.

Module	Starter	Business	Enterprise / MSSP
Attack surface management	included	included	included
Vulnerability management with CTEM workflow for external, internal and cloud findings	included	included	included
Dark web monitoring	included	included	included
Early warning Threat Center, EPSS, CISA KEV	included	included	included
Lookalike domains	included	included	included
Supply chain monitoring Supplier ratings A to F, ransomware watchlist; 5 suppliers included, expandable	included	included	included
AI analysis and remediation plan	included	included	included
Cloud connectors AWS, Azure, Microsoft 365, GCP, Cloudflare, Hetzner	included	included	included
Reports, alerts, mobile app, REST API	included	included	included
SSO via Microsoft Entra ID and Google	included	included	included
Sentry: internal scans and Active Directory	5 assets incl.	expandable	expandable
Penetration testing (PTaaS)	optional	optional	optional
Tenants, portfolio dashboard, white label	not included	not included	included
Dedicated contact and onboarding	not included	on request	included

Common questions about pricing and licensing

: The price of blacklens.io follows scope: the number of external and internal assets, of users for dark web monitoring and IAM and of suppliers in supply chain monitoring (5 per workspace included, more licensed like Sentry assets), and optionally the test cadence for penetration testing. Every licence includes every module, from attack surface management and early warning to AI analysis, reports, integrations, REST API and mobile app. You pay for scope, not for features. You get the price for your scope through the price indication, usually within one business day.
: An external asset is any object in your scope: a domain, an IP address, a cloud service or a server. Subnets are expanded to the addresses they contain and counted accordingly. Assets not seen for 7 days drop out of the inventory automatically. Internally, every host checked by the Sentry scanner counts.
: 5 Sentry assets are included in every workspace, and the scanner appliance itself (VM or Docker) is free and can be deployed as often as you like. Beyond that, licensing is per internal asset. You get the exact price for your number of internal hosts through the price indication.
: 5 suppliers are included in every workspace, with grade, findings, alerts and reports. Like Sentry assets, suppliers are a licensed count of their own: if you need more, your blacklens.io partner or our sales team extends the supplier licence of your workspace. The 14-day trial includes supplier ratings as well. You get the exact price for your number of suppliers through the price indication.
: For dark web monitoring and IAM analysis, blacklens.io counts active users with a mailbox. This number determines which identities are watched in stealer logs and combolists as well as in your directories. Compromised accounts are automatically classified as employee or customer. You can adjust the number of users at any time during the term.
: Penetration testing as a service is optional and licensed separately as a pentest licence, based on test targets and test cadence. OSCP-certified pentesters test inside the same platform on the cadence you choose, from weekly to yearly. Their findings are marked as verified, backed by evidence and retested after remediation. You get the price for your scope through the price indication.
: Yes. Value added resellers and managed security service providers get dedicated partner terms, tiered by volume. For MSSPs, blacklens.io offers multi-tenancy with separate workspaces, a portfolio dashboard across all customers, custom roles, global alert recipients and white label. See the partner page for details or ask in the partner call.
: We offer annual contracts with flexible scaling: you can adjust assets and users up or down at any time during the term, for example when new sites or domains are added. Term and cancellation details are part of the quote. The 14-day trial ends automatically without cancellation and at no cost.
: Yes. The trial runs for 14 days with the full feature set for your domain, no credit card, and your workspace is ready within 24 hours. You see real results for your attack surface before you choose a configuration. On request we show you the platform in a demo first.

Start with your domain.

See real results for your attack surface before you choose a configuration.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings