How it works
From scope to certificate, in six steps.
An Aveas engagement has a clear start, a clear record and a clear finish. Here's what happens at each step, what we need from you, and what you get.
Request an invite-
Scope
What happens: A call with your pentester to agree what's in scope (apps, APIs, environments, cloud accounts), what's out, the testing window and who to contact if something goes wrong. These are the rules of engagement, and we put them in writing.
From you: A list of assets, test accounts for each user role, and whether we test staging or production.
You get: A written scope and test plan, signed off before testing starts.
-
Test
What happens: Continuous AI scanning starts and keeps running. In the agreed window, your pentester tests by hand: business logic, access control between users and tenants, and chains of smaller issues. The AI covers breadth; the pentester covers depth.
From you: A contact who can answer questions during the window.
You get: Testing that stays inside the agreed scope and hours.
-
Report
What happens: Findings appear as soon as a pentester has confirmed them, not weeks later. Each one has the affected endpoint, steps to reproduce, evidence, a severity based on real exploitability, and a fix.
From you: Nothing, unless you want to discuss a finding. You can ask the pentester directly.
You get: Verified findings, live, ranked by what matters.
-
Fix
What happens: Findings become tickets in Jira or issues in GitHub, and your team gets a Slack message when something needs attention. Engineers fix them in their normal flow.
From you: The fixes. We find and verify; we don't change your code.
You get: Tickets your engineers can act on without a meeting.
-
Retest
What happens: When a finding is marked fixed, we retest it. It closes only when the fix is confirmed.
From you: A note that the fix is deployed to the tested environment.
You get: A record that separates "marked resolved" from "verified fixed".
-
Certificate
What happens: We issue the final report and a letter of attestation summarizing the scope, dates, method and outcome. Continuous scanning carries on, so the next test starts from today's picture, not last year's.
From you: Nothing.
You get: An audit-ready report and a letter you can share with auditors and customers.
Common questions
Is this a pentest or a scanner?
Both. Continuous scanning gives breadth between tests; manual pentesting finds what scanners can't reason about. Every finding is verified by a person.
Will testing take our site down?
Testing is planned to avoid disruption: we agree windows, rate limits and anything off-limits at scoping, and stop at once if you ask.
Staging or production?
Either. Many teams test app logic in staging and check configuration in production. We'll recommend an approach on the scoping call.
Can you test behind a login?
Yes. You give us test accounts for each role, and we test what each role can reach, including whether one user can reach another's data.
Do you fix the vulnerabilities?
No. We find them, show how to fix them, and verify the fix. Your team stays in control of your code.
What is the AI doing, exactly?
Mapping your attack surface, running broad checks on a schedule and on deploy, and drafting candidate findings. A pentester confirms every one before you see it.
How long does a test take?
It depends on scope. You'll get a timeline in writing after the scoping call.
How is it priced?
By scope. After the scoping call, we send a written proposal.
Aveas is invite-only.
We take on a small number of teams at a time, so every engagement gets a named pentester and a real scoping call. Tell us what you need to test and when your audit is.