Overview

runZero combines active scanning, passive sampling, and API integrations to maintain an inventory spanning IT, OT, IoT, cloud, mobile, and remote assets. That multi-method approach is useful when a team cannot rely on one source to reveal its full environment. The inventory extends beyond devices to services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups.

The agentless model avoids deploying agents, supplying authentication, or adding appliances, reducing collection overhead. It does not eliminate setup privileges: Explorer installation on Windows, Linux, or macOS requires administrative or root access. Teams can choose hosted SaaS or an on-premise arrangement with Consoles, distributed Explorers, and a command-line tool. The console itself can be self-hosted only with a Platform license and runZero Care, so organizations seeking self-hosting should budget for both.

Key features

Discovery, inventory, and reporting

Hardware, software, cloud, and network discovery draw on active scans, passive traffic, and connected APIs. This breadth is a strength for mixed environments, while its usefulness depends on reaching the systems and network segments that matter. Reports include layer-2 topology maps and asset risk, helping teams see both network relationships and exposure rather than just count discovered assets.

Alerts and integrations

Alerts can appear in-product, arrive by email, or go to webhooks including Slack. Prebuilt integrations cover cloud providers, EDR and MDM tools, vulnerability scanners, ITSM systems, and detection platforms; a Custom Integration API and scripts provide additional extension paths. That range can fit into an existing security stack, although teams should account for the work of connecting and maintaining the systems they depend on.

Security and support

runZero has completed a SOC 2 Type II audit covering the security Trust Service Criteria. It says customer data is logically separated and encrypted in transit and at rest. Documentation, API resources, release notes, a Trust Center, and human support through the console or contact form give teams several routes to operational help.

Pricing

runZero uses a freemium model, with a free plan and paid plans from $5,000.00 USD per contact. A 21-day trial is offered. The published Platform price is contact-based, so buyers should confirm the contract scope before comparing total costs.

Plan	Price	Limits and fit
Community Edition	0.00 USD per free	Up to 100 assets, 1 organization, 10 recurring tasks, and 30 days of data retention. Designed for small businesses, individuals, and security researchers; the asset and task caps make it a starting point, not an enterprise-wide tier.
runZero Platform	5000.00 USD per contact	Asset limit set by contract, unlimited organizations, projects, and recurring tasks, and 3 years of data retention. Built for enterprises; optional self-hosted console requires runZero Care.

Community Edition gives smaller teams a no-cost way to maintain a limited inventory, but its 100-asset ceiling, single organization, task allowance, and shorter retention constrain broader use. Platform removes those stated organization, project, and recurring-task caps and extends retention, in exchange for a contract-based price. Self-hosting is not included as a standalone lower tier: it requires Platform plus Care.

Platforms

runZero supports API, Linux, macOS, self-hosted, web, and Windows environments. Explorer binaries are available for Windows, Linux, and macOS, with administrative or root privileges required for installation. The hosted SaaS option avoids operating an on-premise console; organizations that need to host that console must meet the Platform and Care requirements.

Who it's for

runZero is a strong fit for security teams that need a consolidated view across network, cloud, OT, IoT, and remote assets, especially where agentless collection and several discovery methods suit the environment. Community Edition is appropriately scoped to small inventories and individual or research use. Larger enterprises can use Platform's contract-defined asset limit and expanded organizational capacity. It is a poorer fit for buyers who need self-hosting without a paid enterprise license or cannot grant the privileges required to install Explorers.

Pros and cons

Pros

Multiple discovery paths: active scanning, passive sampling, and APIs broaden coverage across asset types.
Agentless collection: no agents, authentication, or appliances are required, reducing deployment dependencies.
Useful operational breadth: topology and risk reporting, several alert destinations, and integrations across security and IT systems support existing workflows.
Meaningful free entry point: Community Edition covers up to 100 assets without charge.

Cons

Free-tier ceilings: one organization, 10 recurring tasks, and 30-day retention may be restrictive beyond a small environment.
Self-hosting adds cost and terms: hosting the console requires both Platform and runZero Care.
Explorer setup still needs elevated access: agentless does not mean privilege-free installation.
Platform pricing requires a sales conversation: the price is contact-based and the asset limit is contract-defined.

Alternatives

For broader comparisons, see Exposure Management Software, Attack Surface Management Software, Network Discovery Software, and IT Asset Discovery Software.

Mondoo CSPM is worth considering for teams seeking free-forever cloud, Kubernetes, OS, SaaS, and API scanning through its Open Source Tools plan.
ZEST Security offers a 14-day billed trial with one cloud project/account and configuration-focused drift detection, a narrower starting point for teams evaluating that scope.
Qualys Enterprise TruRisk Platform is another paid platform with a free plan and support across mobile, desktop, web, API, and self-hosted environments.
XM Cyber Exposure Management is a subscription-based SaaS alternative with API, desktop, web, and self-hosted platforms.
IONIX uses annual subscriptions priced around discovered fully qualified domain names, making it a relevant alternative when that is the preferred pricing basis.
Outpost24 Attack Surface Management uses custom packages shaped around cybersecurity goals, teams, and timelines.
Check Point Exposure Management is a paid alternative for buyers prepared to contact the vendor for a demo and pricing.
Obsonis Exposure Management Platform offers a $25.00 USD per month Small Business Remote plan, billed per license, with up to 50 licenses and unlimited assets.

Verdict

Choose runZero when the priority is a continuously updated, agentless inventory built from scanning, passive observation, and integrations across a varied environment. Community Edition provides a credible small-scale entry point, while Platform supports enterprise use with longer retention and contract-set capacity. Look elsewhere if self-hosting must avoid a Platform license and Care package, or if the free tier's asset, organization, task, and retention limits do not match the environment.

	runZero	ServiceNow Discovery
Free plan	Yes	No
Free trial	Yes	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Web, Windows	Web
Free plan	Yes	No

runZero vs ServiceNow Discovery

runZero

ServiceNow Discovery