Comparison · Recon and ASM

Crossfyre vs Trickest

Two takes on workflow-driven offensive recon, at very different price points.

Trickest is a commercial visual workflow platform for offensive security. Its public plans are a free Community tier (restricted to non-commercial use) and a custom-quoted Enterprise tier, with nothing self-serve in between. If you do paid work but aren't an enterprise buyer, you fall in the gap. Crossfyre is built for exactly that gap.

Every claim about the other tool is taken from its own documentation and pricing as of mid-2026. Re-check before quoting a number.

Standards

What it covers, and what it will not claim.

Pick a list. Every row that says yes names the class that does the work, and every row that says no says why, because a coverage matrix with no gaps in it is a brochure.

8 covered 1 partly 1 not claimed The list this engine was built against. Eight fully, one partly, and one that nothing on the outside can honestly report.

• API1 Broken object level authorization yes
• API2 Broken authentication partly
• API3 Broken object property level authorization yes
• API4 Unrestricted resource consumption yes
• API5 Broken function level authorization yes
• API6 Unrestricted access to sensitive business flows yes
• API7 Server side request forgery yes
• API8 Security misconfiguration yes
• API9 Improper inventory management yes
• API10 Unsafe consumption of APIs no

MITRE ATT&CK is deliberately not here. It describes what an adversary does across a whole intrusion, and almost all of a web scanner collapses into one technique in it. A six-row ATT&CK matrix would look impressive and tell you nothing, which is the opposite of what this section is for.

Questions people ask