Bounded reconnaissance
Opt in on verified public targets to check a fixed list of common TCP ports plus bounded DNS and RDAP context—never arbitrary ranges, credentials, brute force, or exploitation.
Automated web security assessment
See your website the way an attacker starts.
Find exposed weaknesses, unsafe configuration, and known vulnerabilities—then keep watching as your application changes.
Passive quick viewVerified active testingActionable reports
Run a quick security view
Enter a public website. We inspect its externally visible security posture without attack payloads.
TransportTLS and certificate health
ApplicationOWASP-oriented web checks
ExposureKnown CVEs and risky services
ResponsePrioritized remediation
Latest private-beta capabilities
Move from public exposure to evidence-backed decisions.
RunPenTest combines authorized assessment, customer-supplied evidence, and clear assurance labels without pretending automated testing is a human pentest.
MITRE ATT&CK® is used for defensive relevance mapping. A mapping never claims that attacker activity occurred.
Imported network evidence
Bring authorized Nmap XML or supported JSON into the workspace. We parse and report the inventory without contacting the imported hosts.
Corroborated findings
Track validation sources and automatically corroborate exact cross-engine matches while preserving every analyst decision.
Adversary relevance
Use conservative MITRE ATT&CK® and Cyber Kill Chain mappings for defensive prioritization—not as a claim that attacker activity occurred.
Live assessment log
Follow queue position, retained lifecycle events, engine progress, cancellations, retries, and safe failure details from one activity timeline.
Analysis-ready reports
Export network inventory, evidence confidence, methodology, limitations, and automated-versus-manual disclosure in PDF, HTML, JSON, CSV, SARIF, or JUnit.
From snapshot to control
A finding is useful only if you can close it.
Every result keeps its evidence, affected URL, severity, history, and recommended fix. Re-assess after a change and watch resolved issues close—or return.
Latest assessmentPosture score 82
High
Exposed software version with known CVE
OpenUpgrade the affected component and re-run verification.
Medium
Content Security Policy is missing
OpenDeploy a restrictive policy in report-only mode first.
Fixed
Session cookie lacked Secure attribute
ClosedResolved in the latest assessment.
Verify ownership once
Use a DNS TXT record, a well-known verification file, or an HTML meta tag before active testing.
Choose the right depth
Quick, passive, standard, and deep profiles clearly separate observation from active testing.
Stay on schedule
Monthly, weekly, or daily assessments are driven by plan frequency—not arbitrary scan credits.
Share evidence
Export technical and executive-ready reports in PDF, HTML, JSON, CSV, SARIF, or JUnit.
Frequency-based plans
Compare plans