Scanners tell you what is there. SecQon proves what is exploitable.

A scanner reports what it can see and leaves you to work out what it means — which is why a typical report runs to hundreds of entries, most of which are not reachable, not exploitable, or already mitigated somewhere else in your stack. SecQon takes each candidate finding and tests the claim: is this actually reachable, does the affected path exist, does the evidence hold together. Findings arrive labelled with what we actually established — demonstrated when a bounded proof-of-exploit changed how your application behaved, confirmed when a re-test observed the same thing again, likely when we saw it once and could not reproduce it, unconfirmed when only a tool reported it — each with the evidence attached, so triage is a decision rather than an investigation.

It is automated external testing with a validation layer, and we describe it that way deliberately. It covers a good deal of the ground an external pentest covers — security headers and cookie flags, TLS and certificate posture, deprecated TLS versions, DNS and email spoofing (SPF, DMARC, CAA, DNSSEC), exposed services and open ports, technology fingerprinting, exposed version-control and build files, CORS policy, unencoded reflection of request input, third-party scripts loaded without integrity pinning, and template-driven checks for known-vulnerable software. On the tiers that include it, the pentest layer adds crawling and testing behind your login, an active scanner sending real payloads for path traversal, OS-command injection, server-side template injection, XXE, XPath, open redirect and CRLF, object-level authorization testing (IDOR/BOLA) and mass-assignment probes against your API's own schema, and a measurement of how much of that your WAF actually blocked. It produces the same class of report. That reaches six of the OWASP Top 10 categories with a purpose-built test — A01, A02, A03, A05, A06 and A08 — plus A07 only where a template recognises a service still answering on its shipped default credentials. Those are the categories a purpose-built test reaches on every profile. The remaining three are each named on the face of every report: A04 (Insecure Design) and A09 (Logging and Monitoring Failures) are not observable from outside at all, and A10 (SSRF) is confirmed out-of-band — the proof is your server calling a collector we run, which is never visible in a response, so it is a Deep-profile check and a report from any other profile states that SSRF was not assessed. What it is not is a human red-teamer chasing business-logic flaws, and no automated product should claim otherwise. Many teams use SecQon continuously and still commission a human pentest once a year.

No, and that is deliberate. Every asset must be verified as yours by a DNS TXT record, a hosted file, or a meta tag before a single request is sent. Unverified assets cannot be scanned at all. The one exception is the free exposure check on this page, which is strictly passive — a DNS lookup, a few short TLS handshakes (including ones that offer TLS 1.0 and 1.1, to see whether they are still accepted) and a couple of ordinary HTTPS GETs of your homepage. No ports are swept, no payload is sent and no path is requested beyond the one you give it.

The engine is bounded and non-destructive by design: it is rate-limited per host, refuses anything resolving to a private or reserved address, and holds to the scope you verified — no wandering onto a neighbouring host. On the Light and Standard profiles it sends no attack payloads at all; validation there re-tests that a finding is still observable, and does not try to exploit it. The penetration-test tier does send real payloads — path traversal, OS-command injection, template injection, XXE and the rest — because that is what distinguishes it, which is why it is never on by default and asks you to acknowledge its intrusiveness on every scan. At no depth does the engine delete data, deny service, establish persistence, move laterally, or extract data in bulk.

Every finding about your site carries a severity, an exploitability verdict, the evidence behind it, a plain-English explanation of the risk, and specific remediation — plus a CVSS score wherever the source that produced the finding publishes one. Findings are mapped to OWASP Top 10 categories and SOC 2 Trust Services criteria wherever they apply, so the report can go straight to an auditor or a customer's security team. Reports export as PDF and can be shared through a link.

Adding a domain and publishing the verification record takes a few minutes; DNS propagation is usually the longest part. Once an asset is verified you can launch a scan immediately, and results land in hours rather than the weeks a scheduled engagement takes.

Everything runs on Google Cloud in asia-south1 (Mumbai), and your findings and their evidence live in that database. The model is Gemini on Vertex AI in the same region, and it sees only normalised finding fields and short evidence snippets that have been minimised and then redacted — secrets, tokens and personal data are stripped in the pipeline rather than trusted to a prompt, and credentials you give us for authenticated scanning are encrypted at rest and never enter a prompt at all. On the Free plan and on a Light scan no model is called. Findings, evidence and reports belong to your tenant and are never used to train a model. Authorisation events — agreements accepted, assets verified, scans attested, scope refusals, share links issued — are written to an append-only, hash-chained log. The full account is at secqon.com/legal/privacy.

Nothing breaks. The free tier covers one verified asset, indefinitely, with no card on file, and you can launch the full non-intrusive check set on it yourself whenever you like. What paying buys is the written report and the questionnaire pack, more assets, authenticated scanning behind your login, faster automatic monitoring on the full check set rather than the passive one, and — higher up — the penetration-test tier. If you never upgrade, that free asset keeps being tested.