XBOW Pricing in 2026: What It Costs Now That the List Prices Are Gone

XBOW (xbow.com) is an autonomous AI penetration testing platform, and until mid-July 2026 it was the rare offensive-security vendor that printed a real dollar figure on its pricing page. Check that page today and the numbers are gone, replaced by “Pricing is scoped to your environment” and a Request Pricing form.

Budgeting for XBOW is now a two-part exercise. You need the published prices it retired, which still anchor any negotiation, and you need to understand the usage-based model that replaced them.

Every claim below was re-verified against xbow.com and docs.xbow.com in late July 2026. The comparison running throughout is CodeAnt AI, the exploit-based agentic security platform that still publishes its rates.

Short answer: XBOW no longer publishes pricing. Its pricing page shows no dollar figures, describes “usage-based pricing that scales with your coverage, not a fixed annual engagement,” and routes every buyer through a Request Pricing form or demo, as of late July 2026. Until mid-2026 the self-serve Lightspeed product listed $4,000 (Plus) and $8,000 (Premium) per test. XBOW’s own launch announcement still states “Pricing for XBOW Pentest On-Demand starts at $4,000,” and there is no free trial or free tier.

How Much Does XBOW Cost in 2026?

XBOW’s price is whatever sales quotes for your environment, because the official pricing page carries no tiers, no per-test rates, and no calculator as of late July 2026. The page’s headline is “Autonomous Offense, At Any Scale,” and it states that XBOW “runs offensive security testing across your entire portfolio, from a single application to thousands.”

The page commits to three things about how you will be charged, all qualitative:

• Continuous coverage. The unit XBOW sells is ongoing testing, described as “continuous coverage, not an annual snapshot.”

• Validated findings. Proof-of-concept exploits and remediation guidance are part of the package, described as “validated findings with proof-of-concept exploits and remediation.”

• Usage-based pricing. The bill “scales with your coverage, not a fixed annual engagement.”

For planning purposes, the retired list prices below remain the best public anchor anyone has. XBOW published them recently enough that any sales team will recognize them.

Does XBOW Publish Its Pricing Anymore?

No. The published tiers disappeared from xbow.com/pricing in mid-July 2026, and the buying motion is now a Request Pricing form or a demo.

Here is the dated timeline, assembled from XBOW’s own announcements and pages:

The product line still exists. Only its public price does not.

What Was XBOW Lightspeed Pricing?

Lightspeed Plus cost $4,000 per test and Lightspeed Premium cost $8,000 per test until the tiers were retired in mid-July 2026. The $4,000 figure remains verifiable today in XBOW’s own launch announcement, while the $8,000 tier and its value framing survive only in captures of the retired cards.

The tier split keyed on application complexity, with Plus for lightweight apps with simple workflows and Premium for platforms with multiple modules, integrations, and deeper access-control patterns. XBOW’s retired cards equated the tiers to the depth of a 2-week and a 4-week manual penetration test respectively, a yardstick worth bringing to any quote conversation even though the claim no longer appears on live pages.

Both tiers carried the same feature list: an audit-ready report within 5 days, instant re-testing with automated verification, authentication testing covering 2FA and magic links, detailed proof-of-concept exploits, remediation guidance, black, white, or grey box modes, and compliance-mapped reporting. Enterprise stacked on continuous coverage, realtime findings, SSO, API access, and human-directed operatives.

How Does XBOW’s Usage-Based Pricing Work?

XBOW has published no mechanics, so the levers below follow directly from how it describes its own packaging. Use them to shape the quote conversation.

• Coverage. Usage-based pricing that “scales with your coverage” means every application you add to scope moves the number, and a portfolio of thousands of apps is the explicit top of the range.

• Application complexity. The retired Plus and Premium split doubled the price as modules, integrations, and access-control depth grew, and complexity almost certainly still separates quotes.

• Continuity. Continuous testing on every release was always the Enterprise sell, against one-off on-demand tests. Where you land between those modes shapes the contract, a trade our continuous vs annual pentesting guide unpacks.

• Enterprise controls. SSO, API access, IDOR testing, human-directed operatives, and data residency all sit behind the Enterprise gate, so needing any of them moves you into custom territory.

Ask sales three questions up front: what unit the meter counts, what happens to the rate as applications are added mid-contract, and which of the capabilities you need are Enterprise-gated.

Can You Buy XBOW Through Cloud Marketplaces?

Yes. The pricing page states that “XBOW is available on AWS, Google, Oracle, and Microsoft marketplaces” and invites you to “buy through agreements you already have and put your committed spend to work.”

Marketplace procurement is the one concrete buying detail left on the page, and it matters for enterprise budgets because committed cloud spend can absorb the contract. XBOW also announced AWS Security Competency status on July 7, 2026, which formalizes its standing in the AWS ecosystem.

Does XBOW Have a Free Trial?

No. There is no free trial, no free tier, and no self-serve signup anywhere on the official site, and every call to action resolves to a demo request or the Request Pricing form as of late July 2026.

That gap matters because the November 2025 launch described a “fully self-service experience without scoping calls or kickoff meetings.” Whatever the product experience is once you are a customer, the buying motion today is sales-assisted.

If you want exploit-proven findings before any procurement step, that is what CodeAnt AI’s free first black-box scan provides: point it at a URL, get exploit-verified findings in a 48-hour report, and pay nothing unless a working proof-of-concept exploit ships.

How Does XBOW Compare to a Traditional Pentest on Cost?

XBOW’s own launch post frames the comparison, stating that “traditional pentesting can take 35 to 100 days from scheduling to final report, often costing $10,000–$35,000 or more.” The retired $4,000 entry price sat well under that band, which was the whole pitch.

Whether the quote you receive preserves that traditional-pentest advantage is exactly what the negotiation now decides. Our penetration testing cost guide puts the wider market numbers in one place.

Which XBOW Alternatives Publish Their Pricing?

Transparent pricing is the single easiest filter in this category, and a few credible platforms still print real numbers. Each price below comes from the vendor’s own live pricing page, verified in July 2026.

CodeAnt AI is the only platform on that list where the pentest itself bills on outcomes, with payment triggered by a working proof-of-concept exploit and nothing owed when nothing exploitable is found.

Is XBOW Worth It in 2026?

If your risk sits in web applications and their APIs, XBOW’s core trade is strong, because autonomous testing that proves exploitability beats scanners that list possibilities. The price of that trade is now invisible until you are in a sales cycle, and the scope stops at the web layer.

The proof behind the product is real. XBOW ranked #1 on HackerOne above every human researcher, placed as the first autonomous system on Microsoft’s MSRC leaderboard, and reports 14,000+ zero days found in customer applications, all claims it makes on its own homepage.

Whether that is worth an unquoted amount depends on how much of your risk is web-facing, and whether a per-coverage subscription beats paying per proven finding. CodeAnt AI takes the opposite line on that last question, with billing that starts only when a working exploit is proven.

What to Watch Before You Sign Up

Each item below is visible on the official record, just not on the pricing page.

• The prices left recently. A page that listed $4,000 and $8,000 in mid-July 2026 now shows nothing, and repricing behind a quote wall rarely means the number went down.

• No trial softens the demo. You cannot run XBOW against your own app before buying, so the proof that is the product’s whole thesis arrives only after procurement.

• Scope is the web layer. Official docs limit targets to web applications and their APIs, which leaves mobile, network, cloud configuration, and source code for other line items.

• The API is still labelled Preview. Piping findings into SIEM or ticketing means building against a preview-stage API, with Microsoft Sentinel and Security Copilot the only named integrations, both in public preview.

• Enterprise gates the governance. SSO, API access, data residency, and IDOR testing all require the custom tier, so a compliance-driven buyer usually cannot stop at the entry quote.

What that spend actually buys, engine by engine, is covered in our XBOW features breakdown.

Where This Leaves You

Budget for XBOW the way you would for any quote-only enterprise tool, with one advantage. Its own press release still says pricing “starts at $4,000,” its own benchmark puts traditional alternatives at $10,000 to $35,000, and those two numbers bracket your negotiation.

XBOW fits when your critical risk is concentrated in web applications, you want autonomous testing with proof, and a sales cycle plus an unpublished rate are acceptable costs of entry. The wider field is mapped in our XBOW alternatives guide.

CodeAnt AI is the call when you want the numbers before the conversation: published per-seat pricing at $20 to $24 per user per module per month, a free exploit-verified first scan with a 48-hour report, and pentest billing that triggers only when a working proof-of-concept exploit ships.