OWASP ZAP · baseline and full
Web applications
Active testing for injection, access control, and the rest of the OWASP Top 10. Authenticated scanning is on the roadmap.
Platform
The command center for offensive security.
Asset inventory, scan orchestration, risk lifecycle, pentest engagements, and reporting in one multi-tenant platform with enterprise controls throughout.
Scan pipeline
Orchestration built for hostile work
Scans run in sandboxed containers with dropped capabilities and hard memory limits. Priority queues keep fast checks from waiting behind deep crawls, and per-engine circuit breakers contain failures.
- Isolated execution: containerized engines, no privilege escalation
- Four priority queues so quick scans never starve
- Automatic retry with backoff, dead-letter queue for forensics
- Per-plan concurrency so one team cannot drown the cluster
Findings and risks
A risk model, not a CSV dump
Raw findings are scanner-native and ephemeral. Risks are deduplicated, long-lived, and owned. That distinction is what makes remediation trackable.
- Fingerprint dedup across scans and engines
- CVSS, CVE, CWE, and OWASP Top 10 mapping on every risk
- Lifecycle states from open through accepted to verified fixed
- Request and response evidence captured per instance
PTaaS
Human expertise, productized
Manual engagements live in the same platform as your scans: scoped in writing, led by a named tester, discussed in engagement chat, and closed with customer signoff.
- Engagement letters before kickoff, signoff at completion
- Recurring quarterly, semi-annual, or annual cadences
- Completion certificates with QR-verifiable public links
- Findings flow into the same risk queue as automated scans
Visibility
Posture you can put in front of the board
Health scores per target and per organization, mean time to remediation, and trend lines that show whether the program is actually working.
- Org and target health scores
- MTTR tracking across severities
- Risk trend snapshots over time
- Public security badge for your own trust page
Automation
Everything on a schedule, everything via API
Cron-style scan schedules, recurring report delivery, HMAC-signed webhooks with delivery history, and a REST API behind scoped keys.
- Scan schedules per target or in batches
- Recurring reports emailed to stakeholders
- Webhook retries with automatic circuit breaking
- API keys with granular scopes and expiry
Enterprise controls
Controls your security team will sign off on
Role-based access with custom roles, organization-wide MFA enforcement, OIDC single sign-on, IP allowlists, and an exportable audit trail of every action.
- Roles: owner, admin, member, viewer, plus custom roles
- TOTP MFA, enforceable org-wide
- OIDC SSO with domain allowlisting
- Tamper-evident audit log, archived and exportable
How it works
Scope. Test. Triage. Verify.
A continuous loop, not a yearly ceremony.
Scope
Add domains, IPs, and applications as targets. Prove ownership with a DNS record or well-known file so nothing gets scanned that should not be.
Test
Automated engines run on your schedule. Expert pentest engagements run on a recurring cadence with scope agreed in writing first.
Triage
Findings are deduplicated into risks, AI-vetted for false positives, and ranked by severity with evidence attached.
Fix and verify
Push risks to Jira and Slack, track remediation against MTTR, and run a new scan to confirm the fix actually landed.
Coverage
Point it at what you actually run.
Web apps, APIs, transport security, and the long tail of known CVEs, with discovery to find what you forgot you exposed.
ZAP API scan · OpenAPI import
APIs
Import an OpenAPI spec and test the API surface your SPA and partners actually call.
SSLyze
TLS and certificates
Protocol versions, cipher suites, certificate chains, and HSTS posture across every endpoint.
Nuclei · CVE and misconfig packs
Known CVEs and misconfigurations
Thousands of community-maintained templates matched against your stack, updated as new CVEs drop.
Built-in discovery
Subdomain discovery
Enumerate subdomains you forgot existed, then review them and add the live ones as targets.
Nessus · Dependabot · Snyk
Bring your own findings
Import Nessus results, or findings from GitHub Dependabot and Snyk (Dependabot and Snyk on Enterprise), to triage everything in one queue.
Integrations
Findings go where your team already works.
Push risks into your tracker, alert the right channel, and automate everything over a signed webhook or the REST API.
Tracking
Jira
Create and sync issues from risks.
Alerting
Slack
Scan and risk events in your channels.
Alerting
Microsoft Teams
Native notifications for security events.
Alerting
PagerDuty
Page on-call when criticals land.
Automation
Webhooks
HMAC-signed events with retries.
Automation
REST API
Scoped API keys for machine access.
Assets
Cloud import
Pull assets from AWS, Azure, DigitalOcean, Linode.
Identity
OIDC SSO
Single sign-on with your identity provider.
Early access
See the whole loop on your own assets.
Request early access and tell us what you run, so the pilot starts on your own assets.