Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

VAddy review

#20 of 34 in Vulnerability Scanning SoftwareWeb Application Security Scanners

Authenticated DAST with CI workflows, scheduled scans, and reporting for web applications and APIs.

7.0/10Editor score
Visit VAddy
VAddy7.0 Visit VAddy

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

VAddy is a cloud-based dynamic application security testing service for web application developers and DevOps teams. It sends HTTP requests to test environments, analyzes responses, and supports public web servers, authenticated applications, SPAs, API servers, intranet sites, and local development servers. Its detection coverage includes SQL injection, cross-site scripting, command injection, CSRF, SSRF, XXE, and other web vulnerabilities. Web application teams that need authenticated DAST across development and deployment workflows are the clearest fit.

Pricing is paid-only, with a seven-day trial rather than a permanent free plan. Published pricing starts at ¥19,800 and excludes tax. The Professional plan includes 5 vulnerability checks, 3 registered FQDNs, unlimited scans, a 2-hour scan limit per scan, 1 concurrent scan, CI integration, and Web API access. Enterprise raises coverage to 11 vulnerability checks, extends the scan limit to 5 hours, allows 3 concurrent scans, and adds organization management. Advanced includes 18 vulnerability checks, IPA Safe Web Site checklist coverage, an 8-hour scan limit, batch scanning, and report consolidation. Each listed tier includes 3 registered FQDNs, so teams should assess that limit against their application estate.

VAddy fits development pipelines through Jenkins, Travis CI, and CircleCI integrations, plus command-line tools, Web API access, cron-based scheduled scanning, email alerts, detailed vulnerability results, and PDF reports. Team accounts, organization management, and role-based permissions support shared security operations, while PrivateNet extends scanning to intranet and local development environments through a remote tunnel. Choose VAddy when authenticated web and API scanning, CI use, and varied target environments matter most. Teams seeking a lower published entry price or more than 3 registered FQDNs should compare alternatives.

VAddy pros and cons

  • Where it wins
    • Authenticated scanning for web applications, APIs, and login workflows
    • CI integration, Web API, command-line tools, and scheduled scans
    • PrivateNet reaches intranet and local development servers
  • Where it doesn't
    • Published starting price is ¥19,800, excluding tax
    • Plans list 3 registered FQDNs
    • Professional includes only 5 vulnerability checks

VAddy fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update