Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Blacklock review

#17 of 29 in Web Application Security Scanners

Affordable DAST with authenticated scans, API testing, automation, and developer remediation guidance.

7.8/10Editor score
Visit Blacklock
Blacklock7.8 Visit Blacklock

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Blacklock is a cloud-first penetration-testing-as-a-service platform for organisations securing web applications and REST APIs. It combines authenticated and unauthenticated DAST with scheduled or on-demand scanning, CI/CD integration, vulnerability reporting, remediation guidance, and targeted retesting. Teams that need recurring application and API security checks, rather than a standalone one-time scan, are the clearest fit.

According to the vendor's pricing page, the Vulnerability Scanning plan costs USD 85 per month, billed monthly, with a 14-day free trial and no free plan. The plan includes authenticated and unauthenticated web application scanning, REST API endpoint scanning, unlimited scheduled and on-demand vulnerability scans, OWASP-compliant reports, and Blacklock API access. The vendor states that pricing is based on the number of web applications, live IP addresses, REST APIs, and repositories, so the starting price is not a per-user rate. Paid capabilities also include real-time results, compliance-oriented reporting, developer remediation code, and targeted vulnerability retesting.

Blacklock connects with GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Vanta, Microsoft Entra ID, Okta, SSO/SAML, Zapier, and Salesforce. Browser-assisted authenticated scanning and CI/CD support make it relevant to development teams that want security checks in delivery workflows, while API access supports integration with internal processes. Its scope covers web applications and APIs, alongside broader offerings for infrastructure and source code, but the listed plan centers on vulnerability scanning. Choose Blacklock if integrated DAST, authenticated testing, scheduled coverage, and remediation workflow support matter more than a broad range of published plans. Teams seeking a product centered on a different security scope should compare alternatives designed specifically for that focus.

Blacklock pros and cons

  • Where it wins
    • Authenticated and unauthenticated web application scanning
    • REST API testing with scheduled and on-demand scans
    • CI/CD, issue tracking, identity, and compliance integrations
  • Where it doesn't
    • No free plan; the free trial lasts 14 days
    • Pricing is based on applications, IPs, APIs, and repositories
    • The published plan focuses on vulnerability scanning

Blacklock fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update