Provable authorization
Ownership challenges, signed scope, and a tamper-evident proof pack — the artifact that separates testing from trespass.
Authorization you can prove.Testing you can defend.
- Ownership verified by record
- Signed authorization
- Complete audit trail
The record
One engagement, three steps, no gap between them.
Authorization, testing, and delivery live in the same record. If a control has not been connected, the screen says so rather than implying coverage.
- 01
Authorize
Prove control of the target with a DNS TXT or HTTP challenge, then capture scope, window, and sign-off as a single record.
- 02
Test
Run against that record. Time windows, scanner IP validation, and an emergency stop gate every action at the source.
- 03
Deliver
Findings carry CVSS, CWE, evidence, and compliance mapping into one exportable deliverable your client can defend.
Capabilities
Built for the work that has to survive review.
Safe-scan gate
Testing windows, source validation, and an emergency stop. Nothing runs outside the authorization you recorded.
Broad scan ingestion
Nuclei, Nessus, Tenable, Qualys, Rapid7, Burp, OpenVAS, Nmap, Acunetix, SARIF, and CSV normalize into one finding model.
Deduplicated findings
Cross-scanner dedup keys on asset, weakness, and severity so the same issue from three tools is one line in the report.
Compliance mapping
Map each finding to SOC 2, ISO 27001, PCI DSS, and HIPAA controls without re-labelling evidence by hand.
Audit-first by design
Every authorization, run, and export lands in the activity trail with actor and timestamp attached.
Where the evidence lives
A record, not a brochure.
Findings carry the tool they came from, the asset they hit, their CVSS and CWE identifiers, and the control they map to. Exports are reproducible from the same underlying data, not retyped for a deck.
Attached to every engagement
- Verified asset ownership
- Signed authorization scope
- Enforced testing window
- Normalized scanner findings
- Compliance control mapping
- Immutable activity trail