Vulnerability scanner
A scanner your engineers won't learn to ignore.
The Aveas scanner runs on a schedule and on deploy. A pentester triages its results, so what reaches your backlog is confirmed and ranked, not every possibility the scanner couldn't rule out.
Pentest evidence for SOC 2 · ISO 27001 · HIPAA · PCI DSS audits
What the scanner looks for
Web applications
Common vulnerability classes from the OWASP Top 10: injection, cross-site scripting, broken authentication, insecure direct object references, security misconfiguration and more.
APIs
Endpoints from your OpenAPI or GraphQL schema, tested for the OWASP API Security Top 10.
Known vulnerable components
Outdated frameworks, libraries and server software with published CVEs.
Transport and configuration
TLS setup, certificate problems, missing or weak security headers, exposed admin panels and debug pages.
Cloud configuration
Publicly readable storage, over-broad roles and risky defaults in AWS, Google Cloud or Azure.
Attack surface
New subdomains and endpoints appearing, so nothing is left out of scope by accident.
Authenticated scanning
Most of an application sits behind a sign-in. Give the scanner test accounts for each role, and it tests what those users can reach, including whether one user can reach another's data. Credentials are agreed at scoping and used only for testing.
On a schedule and on deploy
Set a regular schedule for broad coverage, and trigger a scan from your CI/CD pipeline when you ship. New code is checked soon after it lands, instead of waiting for the next manual test.
Every result triaged before it's a ticket
Scanners report what they can't rule out. An Aveas pentester reviews each result, reproduces the ones that matter, discards false positives and rates the rest by exploitability in your setup. Your engineers see confirmed findings; you can still see everything the scanner raised, if you want it.
Not a replacement for a pentest
A scanner is good at breadth and repetition. It isn't good at business logic, or at chaining small issues into a serious one. That's what the manual pentest is for. With Aveas you get both, and they inform each other: the scanner points the pentester to new code, and the pentester's findings become checks the scanner repeats.
See the platform
Aveas is invite-only.
We take on a small number of teams at a time, so every engagement gets a named pentester and a real scoping call. Tell us what you need to test and when your audit is.