Community runs the whole remediation loop, from scanner to rescan-proven fix, free under AGPL-3.0. Professional and Enterprise are sold per instance per year under a commercial licence, with the install done with your team. No edition caps assets, findings or seats.
Free
For security engineers and small teams who self-host.
The remediation loop end to end, under AGPL-3.0, supported by the docs and GitHub issues. The way to evaluate PYXA on your own scanner data.
€9,000per instance per year
For vulnerability managers running remediation across teams.
Less time on triage, assignment and reporting, with an audit to answer.
from €18,000per instance per year
For CISOs and regulated organisations.
Governance and control for estates that answer to several frameworks.
| Feature | CommunityFree | Professional€9,000 a year | EnterpriseFrom €18,000 a year |
|---|---|---|---|
| Ingest | |||
| Scanners: Qualys, Tenable (cloud, Security Center, Nessus), Rapid7 (console, cloud), OpenVAS | Included | Included | Included |
| File imports: CSV/JSON, SARIF, AWS Security Hub (ASFF), external attack surface, pentest reports (findings only), bug bounty | Included | Included | Included |
| Patch deployment evidence: live Intune connector; WSUS, SCCM, Ansible file import | Included | Included | Included |
| CMDB file import (GLPI, iTop, Lansweeper, NetBox exports) | Included | Included | Included |
| Patrowl, watchTowr, SecurityScorecard live connectors | Not included | Included | Included |
| BloodHound CE and Enterprise, SharpHound import (attack paths, Tier Zero) | Not included | Included | Included |
| Upload keys per connector, push API, pyxa CLI | Included | Included | Included |
| Cross-scanner deduplication | Included | Included | Included |
| Scanner tag sync | Included | Included | Included |
| Defender Vulnerability Management, CrowdStrike Spotlight, Amazon Inspector | Not included | Included | Included |
| Wiz, GitHub Advanced Security, GitLab Security, Snyk | Not included | Included | Included |
| ServiceNow CMDB (asset inventory) | Not included | Not included | Included |
| Connector development on request | Not included | Paid service | Paid service |
| Prioritise | |||
| PYXA risk score 0–100 with sources named, P0–P3 bands | Included | Included | Included |
| Threat intelligence: CISA KEV, EPSS, Exploit-DB, Metasploit, Microsoft Security Update Guide | Included | Included | Included |
| VulnCheck KEV, CERT advisories | Not included | Included | Included |
| Feeds from a mirror or a file (air-gapped installs) | Included | Included | Included |
| Patch Tuesday view | Included | Included | Included |
| Attack surface queue | Included | Included | Included |
| Attack paths in the score (internet exposure plus path, choke points) | Not included | Included | Included |
| CISA BOD 26-04 tiering | Not included | Included | Included |
| Score explanation (the contributions behind each score) | Included | Included | Included |
| Remediate | |||
| Action plans, claim and assign, routine and emergency | Included | Included | Included |
| Closure only on a verifying scan; patch reports kept as claims | Included | Included | Included |
| SLA from first detection, per host, aware of known-exploited dates | Included | Included | Included |
| New plan with host selection by unit, attribute or host | Included | Included | Included |
| Plan page: blockers by cause, funnel, proof gate | Included | Included | Included |
| Plan levers: extend SLA, reassign, escalate, split, carry over | Not included | Included | Included |
| Auto-triage rules | 3 rules | Unlimited | Unlimited |
| Jira ticketing (created, refreshed, closed on proof) | Included | Included | Included |
| GLPI and TheHive ticketing | Not included | Included | Included |
| ServiceNow ticketing | Not included | Not included | Included |
| Remediation knowledge base | Included | Included | Included |
| My Work queue, escalation notices, email digest | Included | Included | Included |
| Webhooks | Not included | Included | Included |
| Govern | |||
| Local accounts and roles (reader, analyst, manager, admin) | Included | Included | Included |
| Risk exceptions, requester ≠ approver | Included | Included | Included |
| SLA extension refused to the plan's own owner | Included | Included | Included |
| OIDC single sign-on (Entra, Okta, Keycloak and others) | Not included | Included | Included |
| LDAP / Active Directory sign-in | Not included | Included | Included |
| Asset assignment: unit tree, attributes, enrichment rules | Included | Included | Included |
| Access scope per person (sees only their units, regions, types) | Not included | Not included | Included |
| Filters by unit and attribute on Action Plans and Evolution | Included | Included | Included |
| Audit trail export (user actions are recorded in every edition) Planned | Not included | Not included | Included |
| Multi-tenant / MSSP mode Planned | Not included | Not included | MSSP licence |
| Report and comply | |||
| Command Center, Evolution, Findings, vulnerability pages | Included | Included | Included |
| CSV reports: exceptions, SLA breach, coverage gap, campaign closeout | Included | Included | Included |
| CISO board PDF (programme report), PCI DSS evidence pack | Not included | Included | Included |
| Benchmarking against your own targets | Not included | Included | Included |
| Compliance self-assessment: NIS2, TISAX, PCI DSS v4.0 | Not included | One of the three | All three |
| Compliance self-assessment: OWASP ASVS, SOC 2, HIPAA, CRA controls | Not included | Not included | Included |
| Software inventory / SBOM view | Included | Included | Included |
| Penetration test engagements and retests | Not included | Included | Included |
| Public API v1 (read) | Included | Included | Included |
| Public API v1 (write), MCP server for AI clients | Not included | Included | Included |
| AIAI always proposes and a person or scanner decides, in every edition. | |||
| Bring your own provider (OpenAI, Anthropic, local model) | Included | Included | Included |
| Remediation guidance drafts | Included | Included | Included |
| Plan proposals, effort estimates, clustering, verification diagnosis, AI review | Not included | Included | Included |
| Plain-language findings filter, knowledge-base drafts, enrichment rule suggestions, auto-triage rule drafts | Not included | Included | Included |
| Routing per task (different model per task, local-only tasks) | Not included | Not included | Included |
| Prompt audit log | Included | Included | Included |
| Operate | |||
| Docker Compose install, HTTPS by default, certificate management | Included | Included | Included |
| Two-day install with your team, remote or on site | Not included | Included | Included |
| Licence | AGPL-3.0 | Commercial | Commercial |
| Support | Docs and GitHub issues | Business hours | Business hours; 24/7 as an add-on |
| Source-code escrow | Not included | Not included | Included |
| Maintenance tasks, connector schedules | Included | Included | Included |
| Pre-computed summaries for large estates (500,000+ findings) Planned | Not included | Not included | Included |
| High-availability deployment review (a service) | Not included | Not included | Included |
| Versioned releases with upgrade notes | Included | Included | Included |
| Long-term support release (security fixes for 12 months) | Not included | Not included | Included |
| Upgrade assistance | Not included | Not included | Included |
Planned marks a feature on the roadmap and not yet shipped. It is listed under the edition it will join.
| Add-on | Price | Notes |
|---|---|---|
| CRA moduleArticle 14 reports, 24 h / 72 h / 14-day clocks, CSAF advisories, VEX, OSV matching, SBOM upload from CI. | Starter, up to 5 products: €7,500 Growth, up to 25: €18,000 Unlimited: €35,000 | Sold on its own with the Community core, or with either paid edition. Counted per product placed on the EU market, not per release. |
| MSSP licence PlannedFor partners running PYXA for several clients; the partner sets its own client prices. | €12,000 platform fee plus €5 per managed asset | Available once multi-tenant mode ships. |
| 24/7 supportRound-the-clock response. | +20% of the edition price | Enterprise only. |
| Extra environmentTest or pre-production. | 25% of the edition price | A production licence is required. |
| Service | Price | Contents |
|---|---|---|
| Air-gapped install on site | Travel at cost | The two-day install, done on site for a network with no outside access. The install itself is included. |
| Training day, remote or on site | €1,500 per day | For analysts or managers; travel extra on site. |
| Custom connector | €8,000–15,000 | Delivered into the product; a Professional or Enterprise feature unless agreed otherwise. |
| CRA readiness workshop | €3,000 | Products, support periods, contacts, first report dry run. |
| Health check | €2,500 | Configuration, scale and upgrade review. |
Penetration tests, vulnerability management programs and compliance audits are run by PYXA Consulting, separately from the product. See the consulting services →
Anything not answered here is a 30-minute call away.
Run the free edition on your own server today, or see PYXA on your own scanner data in a 30-minute demo.
