Evidence on every confirmed finding
The request, the response, the proof of concept, the scope and an integrity badge that shows the bundle was not edited after the scan.
What an evidence bundle containsFor security and compliance owners · updated 2026-10-05
Can I trust a finding?
OWASP Top 10 (2025) and API Top 10 scans with request, response and proof of concept on every confirmed finding; active tests only where ownership is proven.
What this role is usually carrying
- Scanner reports that are mostly noise, so the one real finding is read last.
- Auditors who want proof, not a severity label.
- A yearly penetration test PDF that is out of date by the next release.
- Tools that send request bodies, secrets or code to a third-party AI service.
What changes
OWASP coverage with more than sixty engines
OWASP Top 10 (2025) and the OWASP API Security Top 10, with each result labelled confirmed or observed.
Security testingSecurity in the pipeline, not after it
Fail a build on confirmed findings above a severity you choose; observations never block a release on their own.
Security in CI/CDCompliance evidence as a by-product
Tamper-evident audit logs, exportable findings, WCAG reports and VPATs, produced by the runs you already do.
Compliance evidence, continuouslyTest the AI gateway too
Prompt-injection probes, data-leak detectors, multi-turn attack scenarios scored as reliability floors, and a budget gate, with an evidence envelope per call.
LLM and AI gateway testingProof, not adjectives
- Evidence-backed security findings Why a finding without a request is an opinion.
- Trust centre Where data lives, what leaves the tenant, what we have not certified.
- Vendor evaluation checklist Thirty questions with our answers, including the five that are not yet.
- Compared with OWASP ZAP ZAP’s strengths first; when the free tool is enough.
What we are not for
Stated plainly
- We do not sell a certification: we hold no SOC 2 report and no ISO 27001 certificate, and our controls are described as aligned, never as certified.
- This is not a managed penetration-testing service; no human tester is included, and the agentic loop is gated by authorisation records rather than let loose.
- Exploitation steps are withheld in markets where the law makes them unsafe to offer; scanning and recording remain available there.
Questions buyers ask
How is a confirmed finding different from an observation?
A confirmed finding carries the request, the response and a proof of concept; an observation is a pattern that looks risky but was not proven, such as a missing header. Observations are reported and labelled, and never fail a quality gate on their own.
Can we run scans without data leaving our network?
Enterprise customers can run the platform on-premise or air-gapped with feature parity. On the cloud tenant, scans run from our servers in Mumbai and the results stay in your tenant; no result is sent to an external AI provider.
Who can start an active scan?
Only a user with the security feature granted, and only against a target whose ownership has been proven for that workspace. Exploitation needs a separate, signed authorisation record; the platform refuses to self-authorise.
Next step
Start on the Free plan, or bring one flow from your own product and we record it live.