Questions, answered plainly.
Short, honest answers about Precursor Intelligence: how to get started, what plans and credits cost, how we look after your data and what the product does and does not do. It is free to start with no card, and your data is stored in London.
Getting started
A threat and vulnerability intelligence platform from Precursor Security Ltd, a UK company. It watches the software you use, what you have exposed online and lookalike websites using your name, then ranks what to fix first and explains what to do.
No. It runs in your web browser. Findings come from public internet data, the software you tell us about and files you choose to upload. Nothing goes on your computers or network.
Create a free account. The free plan costs nothing and needs no card. It gives you the full intelligence library, tracking for your own software and alerts about it.
You either pick your software from a catalogue, or let us detect it from your public website, which takes roughly 5 to 30 seconds. You review the list before anything is saved, and detection cannot see anything behind a login.
No. An attack-surface scan maps what your domain exposes to the internet. It is discovery, not a penetration test, and it only runs when you start it.
Yes. Admins invite people by email, and there is no limit on how many people an organisation can have. Each person belongs to one organisation.
Pricing and credits
Free is £0. Basic is £299 a month with 800 credits, Business is £899 a month with 2,500 credits and Enterprise is £2,499 a month with 10,000 credits. Prices are in pounds sterling.
Annual plans are paid upfront and come with bonus credits: 15% extra on Basic (£3,499 a year), 20% on Business (£9,999) and 25% on Enterprise (£24,999).
Yes. Attack-surface scans, brand protection, AI action plans and the API and MCP server need a paid plan. Every paid plan includes all of them; the plans differ in how many credits they include.
Unlocking the results of an attack-surface scan, revealing exposed credentials, brand protection for each domain you watch, writing an AI action plan, mapping a threat report and each API or MCP call.
Running a scan before you unlock it, website technology detection, tracking software, lockfile checks, alerts, webhooks, browsing the intelligence library and PDF exports.
Plan credits reset to your plan’s amount each billing period. Credits you buy as top-ups are kept separately and do not reset. Plan credits are spent first.
Yes. Top-up packs come in 200, 1,000, 5,000 and 25,000 credits, and bigger plans pay less per credit. Free organisations can buy them at Basic prices.
Data and security
In London, in the UK.
Yes, for every account. You sign in with an authenticator app as well as your password, and the app and every protected route check for it.
No. Data is kept apart per organisation in the database, and an API key only ever reaches its own organisation’s data.
API key secrets are shown once and only a hash is stored. Keys can be locked to your IP addresses and given an expiry. Scanner keys and webhook secrets you give us are encrypted.
No. Exposed-credential results show which work email addresses appear in other companies’ breaches and how many passwords are readable, but never the passwords themselves.
Action plans are written only from your organisation’s stored data, never from anything you type.
The product
Every flaw gets a score from 0 to 100 based on four things. Evidence it is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. The score for every flaw is kept up to date as the evidence changes. 85 and above is Critical.
We monitor continuously for newly published, newly exploited and rising-likelihood flaws in the software you track, and tell you as soon as we spot one that affects you, by email, in the app or by webhook.
No. Attack-surface scans run when you start them, and you can compare two scans to see what changed. Lookalike domains are watched continuously for each domain you add.
Yes, through a REST API, an MCP server for AI assistants with 71 tools, and webhooks that send JSON to any URL. There are no ready-made Jira, ServiceNow or PagerDuty connectors.
Every API key can make 60 requests a minute. Each successful call uses credits. Calls refused for a bad key or the rate limit are free, and failed data calls are refunded.
npm files (package.json, package-lock.json, pnpm-lock.yaml and yarn.lock) and Python requirements.txt. Saved files stay under watch and you are alerted as soon as we spot a new incident that affects them.
Not today. Each person belongs to one organisation, so each client would need its own account.
Ready to see it on your own business?
Create a free account, tell us your website and the software you use, and see what matters to you. Or book a demo and we will show you round.