Continuous Web Security,
Simplified.
Purple Team Tools brings web, network, TLS, and cloud scanning together with passive OSINT reconnaissance and public ransomware-claim monitoring — so you can find and fix security flaws before they become a problem.
Why Choose Purple Team Tools?
Built by security professionals for developers who care about security
Coverage Across Your Surface
Web app, network, TLS/SSL, CMS, and vulnerability scanning — plus a passive OSINT recon suite and cloud security posture checks.
Fast & Parallel
Containerized scan engines run in parallel so you get normalized results without standing up tooling yourself.
Built-In Guardrails
Active scans require verified domain ownership, and passive recon stays safe to run. Scan data is encrypted in transit and at rest.
Detailed Reports
Normalized findings with severity ratings, evidence, and downloadable reports — across every scan type in one place.
Comprehensive Scanning Capabilities
All the tools you need in one powerful platform
Web App Scanning
Active and passive scans for OWASP Top 10 flaws like SQL injection and XSS
Network Scanning
Port and service discovery to map your exposed surface
TLS/SSL Analysis
Certificate, cipher, and protocol checks — with an optional deep audit
CMS Scanning
Template-based CMS vulnerability and configuration checks; not an exhaustive plugin or theme inventory
OSINT Recon Suite
Passive subdomain, DNS, WHOIS, typosquat, staff-email, and archived-URL discovery
Microsoft 365 Posture
Read-only Microsoft 365 posture checks for a consented tenant. AWS assessments are not available.
Public ransomware claims
Public ransomware claims about your domains and organization names
File Analysis
Ephemeral static malware analysis of an uploaded file — never executed
More Than Scans
Automation, collaboration, and coverage that grows with your team
Smart Scan & Tool Chaining
Detect the stack, then chain the right follow-up scans automatically (Studio and above)
Scheduled Scans
Run recurring scans on a schedule and track findings over time
Teams & Organizations
Three included members, roles and a shared credit pool on Business.
Local Connector
Network discovery and TLS certificate checks through a self-hosted agent (paid tiers)
Simple, Transparent Pricing
Choose the plan that fits your security needs
What will a website assessment cost?
Choose individual checks or combine them. Credits add up across the selected checks and targets. Scan availability depends on your plan; active web checks require verified ownership.
Current example costs are temporarily unavailable.
The scan review shows the exact credit cost before you start. Informational findings count as observations, not confirmed vulnerabilities. No payment is taken until you confirm checkout.
Monthly Subscriptions
Frequently Asked Questions
Everything you need to know about scanning with Purple Team Tools
What is Purple Team Tools?
Purple Team Tools is a web-based security scanning platform. You launch automated scans against websites and web applications you own or are authorized to test, and receive normalized findings with severity ratings and downloadable reports.
How does pricing work?
Plans are subscription and credit-based. Each scan consumes credits based on the scan type. Monthly subscriptions include a credit allotment, and one-time credit packs are available for extra capacity. You can start for free.
What kinds of scans can I run?
The platform covers web application vulnerability scanning (OWASP Top 10 and beyond), network port and service discovery, TLS/SSL certificate and cipher analysis, and CMS security checks such as WordPress, Joomla, and Drupal. It also includes a passive OSINT recon suite (subdomain discovery, DNS recon, WHOIS, typosquat detection, staff-email discovery, and archived-endpoint discovery), connected cloud posture assessments, public ransomware-claim monitoring, and ephemeral static file analysis.
What is the OSINT recon suite?
A set of passive reconnaissance scans that query only public sources — subdomain discovery, DNS records, WHOIS, typosquat/lookalike detection, staff-email discovery, and archived endpoints. They send nothing to the target, so they are safe to run on any domain.
Can I check my cloud accounts?
Read-only Microsoft 365 posture checks are available after administrator consent. AWS assessments are not available. Other scans cover public websites, networks, TLS, public-source OSINT, uploaded files and local connectors.
Do you offer scheduling, team accounts, and ransomware-claim monitoring?
You can schedule recurring scans. The Business tier includes three members, roles and a shared credit pool. Pro and above includes public ransomware-claim monitoring for domains and organization names. Each run costs 2 credits; recurring runs require explicit opt-in.
Do I need to install anything?
No. Purple Team Tools runs entirely in your browser. You enter a target you are authorized to scan, choose a scan type, and the platform runs the scan and returns a report. The free browser-based Cyber Tools utilities also run locally on your device. Paid plans include a self-hosted Local Connector for network discovery and TLS checks on your authorized internal assets. The connector makes outbound connections to PTT; install it only in networks you manage.
Can I scan any website?
Active scans run only against assets you own or are explicitly authorized to test, and require verified domain ownership. Passive OSINT recon queries public sources only. Scanning targets without permission is prohibited by our Acceptable Use Policy and may be illegal.