Table of contents
20
Read this in 30 seconds: XHack pricing for individual researchers has three plans: Starter at $20 a month, Professional at $49 and Elite at $150, each with a 7-day free trial that is limited to one per person. The plans differ in how much agent work they include, whether unrestricted AI access is on the card, and how much support you get.
- Starter is the cheapest way to try the agent, but it does not list unrestricted AI access. The pricing page lists that from Professional, once your identity is verified, and fully unrestricted AI on Elite.
- Usage allowances are stated as ranges of automatic pentests. Starter is enough for 1 to 4, Professional for 3 to 6 and Elite for 10 to 14, with limits that apply per plan.
- The trial is free, but how you start can change. Depending on XHack’s current requirements you either verify first, or you start with limited access and link a card to claim the trial.
- Card subscriptions can be refunded pro-rata, but crypto payments and AI API credits cannot. You can cancel any time and keep access to the end of the period you paid for.
- The agent is agent-driven, so you confirm every finding. XHack’s Terms say AI output can be incomplete or wrong, on every plan.
If you are weighing XHack pricing, the useful question is not which plan is best. It is which plan fits the way you actually work. A bug hunter who tests a few programmes on weekends needs something different from a full-time freelancer or a malware analyst.
This guide goes through every individual plan, what each one lists on the XHack pricing page, how the trial and verification work, and what billing looks like when you upgrade, cancel or ask for a refund. I run XHack, so I have a financial interest, and I say where a cheaper plan, or no plan, is the better choice.
Here is XHack pricing for the three individual plans as it appears on the live pricing page, checked in late October 2026.
| Starter | Professional | Elite | |
|---|---|---|---|
| Price | $20 a month | $49 a month | $150 a month |
| Automatic pentests | Enough for 1 to 4 | Enough for 3 to 6 | Enough for 10 to 14 |
| Unrestricted AI | Not listed | Unrestricted AI access, once verified | Fully unrestricted AI, once verified |
| Cloud Investigation | Not listed | Listed (limits apply) | Listed (limits apply) |
| Support | Email support | Priority support | 24/7 expert support |
| Extras listed | Report writing, vulnerability analysis, internet search, API access | Bug hunting automation, exploit development assistance, pentest report generation, CVE research, custom API integration | Malware analysis tools, custom payload generation, threat intelligence access, AI Probe (OWASP LLM Top 10 testing), full API access |
All three plans include the autonomous security agent, automated bug hunting, the exploit development pipeline, red team operation planning, advanced threat modeling, AI skills, image reading (OCR) and chat access. Starter’s card also says it is an introductory launch price you can lock in while it lasts.
One caveat sits across the whole XHack pricing table. The pricing page says exploitation and unrestricted features unlock after identity verification, so the plan you pay for and the access you get are two separate things.
At the entry point of XHack pricing, Starter gives you the agent and enough usage for one to four automatic pentests, which fits learning, a hobby programme, or checking whether the agent suits your workflow. The card lists the autonomous agent, the exploit development pipeline, report writing, vulnerability analysis, internet search and email support.
What it does not list is unrestricted AI access. That matters if the reason you looked at XHack is that general assistants refuse offensive tasks. For that problem, read what the unrestricted AI agent is and how access works before you choose.
In XHack pricing, Professional is marked most popular. It lists enough usage for three to six automatic pentests, plus unrestricted AI access once you are verified, Cloud Investigation, bug hunting automation, exploit development assistance, pentest report generation, CVE research and priority support.
For most working bug hunters this is the plan where the agent starts to cover a real workflow: recon, triage and report drafts. The bug bounty toolkit budget shows where Professional sits in a full stack of tools and costs.
Elite lists enough usage for ten to fourteen automatic pentests, fully unrestricted AI once verified, malware analysis tools, custom payload generation, threat intelligence access, AI Probe for OWASP LLM Top 10 testing, full API access and 24/7 expert support.
The extra capability is aimed at people whose work goes beyond web testing: malware analysts, red teamers and researchers who test AI applications. AI Probe tests AI systems against the OWASP Top 10 for LLM applications, which is only useful if you are building or assessing LLM products.
Every individual plan in XHack pricing starts with a 7-day free trial, limited to one trial per person. The trial is free and nothing is charged for the trial period itself.
How you start depends on XHack’s requirements at the time, and those can change. XHack’s billing docs explain the two cases.
| Verification required | Verification optional | |
|---|---|---|
| Before you start | You verify your identity | You start right away with limited access |
| Free trial | No card needed | Link a credit or debit card to claim it |
| What the agent does | Full capability once approved | Finds vulnerabilities and helps, but does not exploit |
If a card is needed, XHack says it tells you before you start whether the trial turns into a paid plan, the price and the date of the first charge, and you can cancel before the trial ends to avoid a charge. If no card is needed, the trial ends on its own, does not become a paid plan, and there is nothing to cancel.
So do not assume either version. Read the screen you see at sign-up. The full rules are in the verification and limited access guide.
What verification involves. Researcher accounts are approved on a government-issued photo ID plus at least one professional credential, such as OSCP, CEH, CISSP or Security+, or a security-related diploma. It takes about five minutes of your time and review is usually decided within one business day. Reviewing your verification is free.
Match the plan to the work, not to your ambition. This is my honest read of XHack pricing.
| You are | Start with | Why |
|---|---|---|
| Learning, or testing the agent on practice targets | Starter | Cheapest way to see whether the agent saves you time |
| A part-time bug hunter on a few programmes | Starter, then Professional if you hit the limit | Pay $20 until the usage or the refusals become the bottleneck |
| A regular bug hunter who wants unrestricted AI access | Professional | The plan that lists it, once verified |
| A full-time freelancer or consultant | Professional or Elite | Priority or 24/7 support, and more usage per month |
| A malware analyst or red teamer | Elite | Malware analysis tools, custom payload generation and threat intelligence |
| Someone testing LLM applications | Elite | The plan that lists AI Probe |
| A researcher who only needs occasional help | Starter plus AI API credits | Pay for extra usage only when you need it |
Two rules of thumb help with XHack pricing. First, if you are not sure, start on the lowest plan that lists what you need and upgrade when you hit a limit, because upgrading mid-cycle is prorated. Second, do not buy Elite for the usage alone if the extras do not apply to you.
For bug bounty work specifically, AI for bug bounty covers what an agent can and cannot do at each stage, and the XHack AI agent for bug bounty shows the workflow.
A few errors come up often, and each costs money or time.
The common thread is to read the details before you pay, which is the point of this guide to XHack pricing.
The three plans above are the individual plans in XHack pricing, for researchers and bug hunters. Three other things are priced separately.
AI API credits. These are a separate prepaid balance. You top it up, and the agent draws from it as it works. XHack’s docs say credits let you keep working after you reach your plan’s usage limit, pay only for what you use, or call the pay-per-use XHack AI API from your own tools. If fallback to credits is turned on, the agent keeps going at your plan limit and uses credits. If it is off, the agent stops. Credits are not part of any plan and are non-refundable. See the XHack AI API and credits guide for how they work.
Company plans. Companies have separate self-service plans at $560, $1,099 and $3,000 a month, with vulnerability assessment scans, a SOC dashboard, GitGuard and team management. Do not quote the $20 to $150 figures as company pricing.
Managed services. If you want certified testers to run the work, managed engagements start at $2,500, with higher tiers at $5,000 and $12,000, delivered with human verification and a retest included. For what the managed tier involves, see AI VAPT services.
The billing rules matter as much as the sticker price in XHack pricing. They come from XHack’s billing docs and its refund policy, last updated on 25 October 2026.
| Question | Answer |
|---|---|
| How can I pay? | Credit or debit card, or crypto |
| Can I upgrade mid-cycle? | Yes. You pay only for the days left in the cycle, get the new plan’s allowance for those days, and the full allowance starts at the next renewal |
| Can I cancel? | Yes, any time. You keep access until the end of the period you paid for and the plan does not renew |
| Can I get a refund on a card subscription? | Yes, pro-rata for the unused part of the current period, if you ask while the period is running |
| Can I get a refund on a crypto subscription? | No. Crypto payments are final |
| Are AI API credits refundable? | No, whether you paid by card or crypto |
| Is the free trial refundable? | Nothing is charged for the trial itself, so there is nothing to refund |
Two details are worth knowing before you pay. A refund ends your plan straight away and any remaining allowance is forfeited, while cancelling lets you use what you paid for until the period ends. And crypto subscriptions do not renew on their own, so there is nothing to cancel in practice.
The pro-rata calculation also deducts metered usage beyond what you were entitled to for the days you used, such as AI tokens or scans. The refund policy has the full rules.
I cannot promise a return from XHack pricing, and no data I have shows how much researchers earn or save with a plan. What I can give you is a way to decide.
At $20, $49 and $150 a month, the plans come to $240, $588 and $1,800 over a year. The right test is whether the agent saves you more hours than that costs in your own time.
Use the trial to test XHack pricing for yourself. Run the agent on a target you already understand, using a scope you are authorised to test, and time how long recon, triage and report drafting take with and without it. Then compare. If the saving is real, pick the cheapest plan that lists what you used.
Also be honest about limits. The self-serve agent is agent-driven, so you confirm every finding before you report it. XHack’s Terms say AI output may be incomplete, inaccurate or wrong, may report false positives and may miss real vulnerabilities, and XHack AI mistakes explains where our own agent gets things wrong. A plan does not change that, and nothing in XHack pricing does.
XHack is not only a subscription. It has three layers: a self-serve AI agent for individuals, a company security platform, and managed services delivered by certified testers, including VAPT, red teaming, a managed SOC, incident response and secure code review.
That matters if your needs grow. A researcher who starts on Starter can later add managed testing for a client, and a team that outgrows individual plans can move to the company platform. Managed engagements have public sample reports you can read first, and XHack does not store your agent chats.
The agent itself is built for authorised work. Researcher accounts are verified, every operation is logged, scope is enforced, and destructive commands are blocked even in the most permissive mode. The unrestricted AI feature page lists the full capability set, and every XHack AI agent feature goes into each one.
XHack pricing for individuals is $20 a month for Starter, $49 for Professional and $150 for Elite, each with a 7-day free trial limited to one per person. Starter’s card says it is an introductory launch price you can lock in. Companies and managed services are priced separately.
Yes. Every individual plan starts with a 7-day trial and nothing is charged for the trial period. Whether you need a card to claim it depends on XHack’s requirements at the time: if verification is required you verify first and no card is needed, and if it is optional you start with limited access and link a card.
The XHack pricing page lists unrestricted AI access, once verified, on Professional, and fully unrestricted AI, once verified, on Elite. Starter does not list it. All unrestricted features unlock only after identity verification.
Yes to both. You can upgrade mid-cycle and pay only for the days left in the cycle, and you can cancel any time and keep access until the end of the period you paid for. Cancelling stops renewal but does not return money by itself.
It depends on how you paid. Card subscriptions can be refunded pro-rata for the unused part of the current period if you ask while it is running. Crypto subscriptions and AI API credits are not refundable, and a free trial has nothing to refund.
The $20, $49 and $150 plans are individual plans for researchers and bug hunters, including someone who buys for personal use while working at a company. Team and company plans start at $560 a month and are a separate product, so do not read the individual prices as company pricing.
XHack pricing is simple on the surface and detailed underneath. Three individual plans cost $20, $49 and $150 a month, and what separates them is usage, unrestricted access, extra tools and support. The trial, verification and billing rules decide how it feels in practice.
Start with the trial, read what you are asked at sign-up, check XHack pricing against your own workload, and pick the cheapest plan that lists what you need. If you outgrow it, upgrading is prorated. If you only need extra usage now and then, credits are an option. And if you want people to run the work, managed testing starts at $2,500.
Start the 7-day free trial on the pricing page and read the verification guide first.
Categories
Related articles
