Licensed to your estate.
Nexich is licensed by in-scope IP address, from a 32-address minimum to 1,024 addresses. One all-inclusive license, no add-on packages. The only variable is how much of your network is in scope. Larger estates are sized with you directly. Self-hosted, and no public price list.
You license the hosts you test.
Nexich is priced on the number of in-scope target IP addresses, the hosts you are authorized to test. Not seats, not per-run. The standard range runs from a 32-address minimum to 1,024 addresses, and larger estates are sized with you directly on the same self-hosted platform.
| Scope | Size | What it covers |
|---|---|---|
| Minimum | 32 IPs | The smallest licence, enough for a focused engagement or a single scoped segment. |
| Common | 256 IPs | A /24 subnet, the usual shape of one office or a flat production segment. |
| Largest standard | 1,024 IPs | A /22 block, the top of the standard range and enough for most single-site estates. |
| Beyond | Talk to us | Larger estates are sized with you directly, on the same platform and the same all-inclusive terms. |
Every license is the whole platform.
Sold as one all-inclusive license, with no add-on packages or paywalled features to buy. Every license includes the complete platform. The only variable is how many in-scope IP addresses it covers.
All operating modes
From the deterministic classic operation to fully autonomous engagements, every mode is included.
Air-gapped AI
Run on a local model with zero egress, or a frontier cloud model when your policy allows.
Isolated validation
Synthesized proofs detonate away from your estate first, in an isolated sandbox where hardware virtualization is available and a constrained host runner otherwise. You choose the in-scope hosts they validate against.
The full attack chain
Recon to a proven exploit, cross-host chains, captured sessions, and reproducible proof.
Self-hosted
Runs on your own metal. Air-gapped on a local model, nothing you own leaves your network.
Reporting and re-test
Executive summaries, evidence, and one-click re-test to confirm a fix holds.
Priced with you, not off a list.
The license follows the estate under test. Tell us your in-scope IP count and we size it together, and nothing about your network has to leave your perimeter to get a number.
The addresses you test.
You license the target hosts you are authorized to reach, never seats and never per-run. The classic deterministic mode stays fully repeatable within that scope.
Grows with your scope.
Start at a 32-address block and scale up to a /24 or a /22, all on the same self-hosted platform. Past 1,024 addresses we size the estate with you.
No public price list.
Scoped per engagement and sized directly with you. Send us your in-scope IP count and we return a quote.