Notra vs PerfAI
Both of us run autonomous AI pentests — same category, so this page is about the differences that matter: how you pay, and whether the evidence ships with the report or waits behind a purchase.
| Aspect | Notra — $149 flat audit | PerfAI — credit-metered |
|---|---|---|
| Category | Autonomous AI pentest: an agent probes your live app and reports verified findings, no human in the loop. | Also autonomous AI pentest for live apps. Same category — we will not pretend otherwise. |
| Target market | Any live web app — the same agent, at the same flat price, whether the code was written by a team or generated by an AI. | Positions specifically for AI-built and 'vibe-coded' applications. |
| Pricing model | ✓ $149 flat, one-shot. The whole report ships whether you buy once or a hundred times — findings are never withheld. | Credit metering: your credit balance controls whether you can scan at all. Per-app subscriptions run $49 (Pro) to $299 (Growth, 1 app). |
| Evidence transparency | ✓ Full evidence shipped with the report — every finding carries its proof, with nothing held back behind a purchase. | Their marketing shows a locked-findings teaser: hidden vulnerability counts that are revealed once credits are purchased. |
| Provenance of a run | ✓ Every run ships a manifest that pins the settings, plus a viewable reasoning trace and a public abuse contact on every request. | The agent produces a narrative of what it did. |
| Social proof | Young product — but every run is manifest-pinned with a public abuse contact, so you can verify the work yourself instead of trusting testimonials. | Publishes no customer logos or third-party reviews yet — normal for an early-stage product, but worth knowing before you buy. |
| Free tier | The scorecard is free forever, plus a first verified audit after you prove ownership of the target. | A lifetime freemium allotment of ~900 credits across up to 2 apps. |
When Notra is the right buy
Evidence shipped, not teased
A vulnerability count behind a paywall is marketing; a request/response exhibit in your report is security. Notra ships the proof with every finding, always.
One price, one scan, everything found
$149 flat — the report is complete the moment it is generated. No credit balance deciding whether you are allowed to scan this week.
You want to verify, not trust
Every run ships a manifest pinning its settings, a viewable reasoning trace, and a public abuse contact. Check the work instead of reading the brochure.
When PerfAI wins
They are the faster mover in the vibe-coder niche, with per-tool landing pages built around specific AI frameworks — if you want a vendor marketing directly to how your app was built, that depth is real. Their API-focused testing heritage is also a fair reason to shortlist them, and their lifetime free-credit allotment lets you kick the tires longer than a time-boxed trial would. The honest version of this page says both.
Questions people ask before choosing
Is credit-based pricing actually bad?
Not inherently — metering works fine when credits are a cost you can see before you commit. The uncomfortable version is when credits control whether you can scan at all, and the number of hidden vulnerabilities is shown before the price of revealing them is. Ask any vendor two questions: can I run one scan and see everything it found for one known price, and what happens to findings I have already paid for if I stop paying?
What does the locked-findings teaser mean?
PerfAI's marketing shows vulnerability counts that stay hidden — locked — until credits are purchased. We think a security report should never be a teaser: if a finding is real, it ships with the request and response that proved it, in the report you already paid for. That is a values difference, and we would rather lose a deal than hold evidence hostage.
Which one should I use on a vibe-coded app?
Both will scan it. PerfAI specializes in AI-built applications and has built per-tool landing pages around specific AI frameworks — if you want a vendor that speaks your stack's language, that is a real reason to look at them. Notra charges the same flat $149 for any live web app and ships full evidence either way.
It costs nothing, takes about a minute, and tells you whether a verified audit is worth your $149.
Prices and capabilities referenced from public sources as of September 2026. Competing on facts — if anything here is out of date, tell us and we will fix it. Related: pricing, the sample verified report, and how this compares with manual penetration testing.