Platform tour
Automated Penetration Testing — Platform Features
A complete walkthrough of PenScan — from adding your first website to sharing a verified security certificate with your customers.
Scanning engine
Seven security tools running at once
Most businesses would need to hire a security team to run these checks. PenScan runs them all automatically — checking for the most common ways hackers break into websites — and combines everything into one clear report.
Checks for SQL injection, XSS & 200+ attack types
These are the most common ways hackers steal data. PenScan tests every input on your site automatically.
Checks your SSL certificate & encryption settings
Weak encryption is like leaving your front door unlocked. We flag it before anyone exploits it.
One clean report — no tool-switching required
All findings from all seven tools are merged and de-duplicated. You see one clear list, not seven separate outputs.
Vulnerability report
A clear list of what to fix, ranked by risk
Every issue we find is sorted from most dangerous to least. You won't need a security expert to interpret the results — each finding tells you what's wrong and why it matters in plain language.
Critical, High, Medium, Low — all clearly labelled
You always know what needs fixing today vs. what can wait until the next sprint.
Plain-English explanation for every issue
No security jargon. Each finding explains what it is, why it's a problem, and how to fix it.
Mark as fixed and verify with a follow-up scan
Track your progress. Mark fixes as complete and re-scan to confirm they're resolved.
Asset discovery
We find the parts of your site you forgot about
Old test environments, forgotten subdomains, internal tools accidentally left exposed — hackers actively hunt for these. PenScan maps everything connected to your domain automatically, the moment you add it.
Automatic — no setup, no configuration
Add your domain and PenScan instantly starts finding connected sites. No credits used, no manual work needed.
High-risk assets flagged immediately
If a discovered subdomain looks exposed or misconfigured, it's flagged so you can prioritise it straight away.
No blind spots — your full attack surface, covered
Most security checks only cover what you manually add. PenScan finds everything, so nothing slips through.
Trust certificates
Show customers you've been security tested
After a scan, you get a verifiable security certificate and a badge you can add to your website with one line of HTML. It's proof — not just a claim — that your site has been professionally tested.
Anyone can verify your certificate is genuine
Each certificate has a unique ID. Customers, investors, and partners can check it's real with one click.
Live badge — always shows your latest status
The widget on your site updates automatically after every scan. No manual updates needed.
Win more deals by showing security proof
Enterprise buyers always ask about security. A verified certificate gives you a credible, verifiable answer.
Team & access
Invite your team — everyone sees what they need to
Add your developers, managers, or external auditors and control exactly what each person can see and do. Your data is always completely private to your organisation.
Owner, Analyst, or Viewer — three clear roles
Owners run scans. Analysts review findings. Viewers read reports. Simple, granular control.
Your data stays private — always
Each organisation's data is completely separate. Your scan results are never visible to other PenScan users.
Full audit trail — every action logged
Every scan, fix, and configuration change is logged with full attribution — useful for security reviews, audit preparation, and demonstrating ongoing testing discipline.
What you get
Everything your team needs to find, fix, and prove it.
From first scan to verified fix, PenScan keeps every finding, remediation action, and testing history in one place — so your team always knows where things stand.
Security testing evidence, audit-ready
Security reviews and audits often require documented evidence of testing and remediation.
PenScan generates PDF reports with scope, methodology, findings, and remediation steps,
and keeps the full scan and remediation history in one place.
Reports and history ready when reviewers ask
Expose the attack surface you didn't know you had
Old subdomains, staging environments, forgotten endpoints — attackers enumerate these before you do.
PenScan automatically discovers every asset connected to your domain before the scan begins,
so nothing gets missed.
No blind spots, no forgotten corners
Authorised scanning — every time
PenScan confirms domain ownership via DNS verification before any scan runs.
You stay legally protected, and no third-party domain can be targeted without proven consent.
Every scan is authorised by design.
Legally sound and ethically enforced
Critical issues first — not the noisiest
Every finding is scored by actual severity. Your team sees what matters most at the top,
assigns issues for remediation, tracks progress, and confirms fixes — all from one live dashboard.
No spreadsheets. No guesswork.
Never lose a critical finding in the noise
Turn a passing scan into a trust signal
Once your site passes a scan, display a verified security badge to customers, prospects, and partners.
A concrete signal that your security posture has been independently tested — not just assumed.
Security posture you can show, not just claim
One platform, the right access for every role
Invite your engineering team, security lead, and compliance officers — each with the exact permissions
their role requires. All scan data stays isolated within your organisation.
No cross-tenant visibility, ever.
Collaborate securely across your whole team
FAQ
Common questions about how PenScan works
PenScan orchestrates seven industry-standard security tools: OWASP ZAP (web application scanning), Nuclei (CVE and misconfiguration templates), Wapiti (SQL injection, XSS, CSRF), Nikto (web server fingerprinting), SSLyze (TLS/SSL analysis), Nmap (port and service discovery), and Dalfox (advanced XSS fuzzing). All results are merged and deduplicated into one ranked report.
PenScan normalises findings from all seven scanners using URL, parameter, and vulnerability-type fingerprints. Duplicate findings pointing to the same root cause — even if detected by multiple tools — are merged into a single record with cross-scanner evidence attached, so you see one issue to fix, not seven separate alerts.
Asset discovery automatically maps all subdomains and exposed assets connected to your domain the moment you add it — using certificate transparency logs, DNS enumeration, and passive reconnaissance. It runs at no cost and never uses a scan credit. High-risk assets (exposed staging environments, legacy servers) are flagged immediately.
A trust certificate is a cryptographically verifiable document generated after a clean scan. It proves to customers, partners, and auditors that your website has passed a recent automated penetration test. Each certificate is tied to a specific scan and can be verified using its unique certificate ID. You can also embed a live security badge on your website with a single line of HTML.
PenScan's Target Guard system requires you to add a unique DNS TXT record to your domain before any scan can begin. This cryptographic token proves you control the domain. No scan is possible without verified ownership — not even by administrators. Users must also acknowledge a legal disclaimer confirming authorisation before each scan.
A full combined scan typically completes in 15–30 minutes, depending on the size and complexity of your target. All seven scanners run concurrently. OWASP ZAP accounts for the largest share of scan time. You receive a notification when your results are ready.
Get started today
Stop hoping you're secure.
Know that you are.
Add your domain, verify ownership with a DNS record, and run your first full security assessment. No consultants, no contracts, no infrastructure to manage.
1 free credit included · No credit card required · Credits valid for 1 year