Pricing that scales with what you monitor
Pick a plan by how many domains you're watching. Domains sharing a server cost less - see how below.
cancel anytime - no long-term contractsFree
1 domain + 1 host
60 tokens/mo
Scanned daily - frequency can't be changed on Free
- Full incident history & audit trail
- No card required
Starter
~5 typical domains
300 tokens/mo
Daily by default - scan up to hourly, change anytime in Settings
top up +100 tokens for $10
- Noise control (muted exposures)
- Full incident history & audit trail
- Email support
Growth
~20 typical domains
1200 tokens/mo
Daily by default - scan up to hourly, change anytime in Settings
top up +200 tokens for $16
- Noise control (muted exposures)
- Full incident history & audit trail
- Priority email support
Enterprise
Custom capacity
Custom token allowance
Custom scan frequency
- Custom token allowance
- Multi-region scanning (as it becomes available)
- Full incident history & audit trail
- Dedicated support
What you get
Every plan sends the same evidence when something changes - not just "a port opened", but exactly what was there before and what's there now.
How much does external attack surface monitoring cost?
It depends on how many domains and servers you're watching, and how often you scan them, but most EASM (external attack surface management) platforms don't publish pricing at all - they're quote-only, built around a sales call, and often run into the thousands of dollars a month once you're past a handful of assets. SurfaceDiff's pricing is posted on this page: a free plan to start, paid plans from $19/month + tax, priced by token, with no contract.
Worked example
A small business monitoring its own domain, on its own dedicated server, scanned once a day, spends 60 tokens/month (2 tokens/scan x 30 scans) - comfortably inside Starter's 300 tokens at $19/month + tax.
A hosting company or agency monitoring 20 client domains spread across 5 shared servers, scanned once a day, spends 750 tokens/month (25 tokens/scan x 30 scans: 20 for the domains + 5 for the shared servers, each counted once no matter how many domains sit on it) - inside Growth's 1,200 tokens at $49/month + tax, with headroom to spare.
Scanning more often
Every paid plan can scan more often than once a day, set anytime from Settings, with no wait for the next billing cycle. Each scan spends the same 1 token per domain + 1 token per server, so scanning more often spends tokens proportionally faster:
- Once a day1× tokens
- Every 6 hours4× tokens
- Every 3 hours8× tokens
- Hourly24× tokens
Questions
How many domains can I monitor?
Starter covers about 5 domains, Growth about 20 - each plan's exact capacity depends on how many separate servers they sit on (fewer, shared servers stretch further - see "What's a token?" below for the exact math, or the worked examples above).
What's a token?
Tokens are how usage is measured: every completed scan spends 1 token for the domain, plus 1 token for each distinct server (host/IP) that domain resolves to. A typical domain on its own dedicated server, scanned once a day, spends about 60 tokens a month. If you run many domains on one shared server (common for hosting companies), the server itself is only counted once per scan - each additional domain sharing it costs 1 token instead of 2, so it goes a lot further than the "~N domains" estimate below suggests.
Can I scan more than once a day?
Yes - every paid plan can be set to scan every 6 hours, every 3 hours, or hourly from Settings, and it takes effect immediately. Scanning more often spends tokens proportionally faster (4x the frequency spends tokens about 4x as fast), so it's a tradeoff you control, not a separate paid tier.
What counts as a domain?
Each root domain or subdomain you add as a monitoring target uses 1 token per scan - SurfaceDiff then discovers and tracks its own subdomains, ports and services underneath it at no extra token cost.
What happens if I run out of tokens?
Nothing you're already monitoring stops: existing domains keep scanning and your dashboard stays fully visible. Running out only blocks adding new domains or raising scan frequency until your monthly allowance refills, or you upgrade or top up.
Can I buy extra tokens without upgrading?
Yes - Starter and Growth can both top up mid-cycle from the Billing page: +100 tokens for $10 on Starter, +200 tokens for $16 on Growth. It costs more per token than the plan itself (and more than upgrading a tier) on purpose - a top-up is meant to get you through the rest of a cycle, not replace upgrading if you consistently need more. Free doesn't offer top-ups; upgrade to a paid plan first.
Can I change plans later?
Yes - upgrade or downgrade at any time; the change applies to your next billing cycle.
Is there a free plan?
Yes - run a free scan or register and add a domain directly, and it monitors on the normal daily schedule - alerts included - for free, no card required, for as long as you want it: 1 domain and 1 server, ongoing. Need more than that - more domains, more servers, or scanning more often than once a day - upgrade to a paid plan anytime.