# SecQon

> Evidence-validated external penetration testing and continuous monitoring. Built by Infiqon Pvt Ltd (India).

SecQon is a self-service external penetration testing and continuous
monitoring platform. You add an internet-facing asset, prove you own it, and we
test it and produce a report you can send to a customer or an auditor.

## What makes it different

Most scanners report what is present. SecQon re-tests every candidate finding
against your live asset before it reaches you, and only a reproduction earns the
word "confirmed". Where a re-test cannot run, the finding says so rather than
borrowing confidence it did not earn.

Every report also names the categories the scan did NOT assess, and why. A
report that is silent about its blind spots makes a claim by omission.

## Scan depths

- **Light** — strictly passive: one HTTPS GET, a TLS handshake, DNS lookups.
- **Standard** — the full deterministic set: security headers, cookie flags, TLS
  and certificate posture, DNS and email spoofing (SPF/DMARC/CAA/DNSSEC),
  exposed ports, technology banners, exposed version-control and build files,
  CORS, unencoded reflection of request input, third-party script integrity,
  form security including CSRF, and the known-vulnerability template sweep.
- **Deep** — bounded exploitation with a per-scan acknowledgement: reflected XSS
  proved with a browser screenshot, SQL injection confirmed by a boolean
  differential that reads no data, out-of-band SSRF confirmed by a callback to a
  collector we run. Plus authenticated testing behind your login and a headless
  browser crawl for single-page applications.
- **Full penetration test** — real attack payloads for path traversal, OS-command
  injection, server-side template injection, XXE, XPath, open redirect and CRLF;
  object-level authorization (IDOR/BOLA) and mass-assignment probes; and a
  measurement of how much your WAF actually blocked.

## OWASP Top 10 (2021) coverage — stated honestly

- A01 Broken Access Control — covered
- A02 Cryptographic Failures — covered
- A03 Injection — covered
- A04 Insecure Design — NOT assessable by any external scanner
- A05 Security Misconfiguration — covered
- A06 Vulnerable and Outdated Components — covered
- A07 Identification and Authentication Failures — partial (default-credential
  templates only; this engine never submits a credential, so password policy,
  lockout and session management are not tested)
- A08 Software and Data Integrity Failures — covered
- A09 Security Logging and Monitoring Failures — NOT assessable externally
- A10 Server-Side Request Forgery — covered, confirmed out-of-band (Deep)

## What SecQon deliberately does not do

- No destruction, no denial of service, no persistence, no lateral movement.
- No business-logic testing. Whether a refund flow can be gamed needs a human
  tester; any automated product claiming otherwise is overselling.
- No invented findings. Every claim maps to a tool result or a reproduction.
- No scanning without verified ownership. There is no override for this.

## Safety and scope

Every outbound packet is checked against the customer's verified-asset allowlist
and pinned to the authorised IP at the moment it is sent, so a hostname that
appears mid-scan cannot widen scope and a changed DNS answer cannot redirect us.
Rate limits and scan windows are enforced at the same boundary.

## Pricing

### Free — $0 forever
- Best for: Prove it finds something real on an asset you own.
- Adds: The full deterministic check set
- Assets: 1 verified asset · Depth: Standard · Cadence: Monthly re-test
- Every non-intrusive check we run: TLS, security headers, cookies, DNS and email spoofing, exposed ports, CORS, exposed VCS and config files, third-party script integrity, and the known-vulnerability template sweep
- Findings with the evidence we observed, and the request that found each one
- Monthly re-test, so you hear about a change
- No written report — findings only. The plain-language report and fix guidance start on Starter
- No card required

### Starter — $49 per month
- Best for: Answering a customer security questionnaire.
- Adds: The written report and fix guidance
- Assets: up to 3 verified assets · Depth: Standard · Cadence: Weekly re-test
- Everything in Free, plus the written report: what each finding means, why it matters, and step-by-step how to fix it
- Security questionnaire pack and attestation summary, answered from your own scan evidence
- Shareable report links with evidence — send one to a customer or an auditor
- OWASP Top 10 mapped to SOC 2, ISO 27001 and PCI DSS, with the categories we cannot assess from outside named on the report's face
- Weekly re-test

### Growth — $149 per month
- Best for: Teams with a real application, not just a marketing site.
- Adds: Deep scans and testing behind your login
- Assets: up to 10 verified assets · Depth: Deep · Cadence: Daily re-test
- Everything in Starter
- Deep scans — we exploit a finding to prove it is real: reflected XSS with a browser screenshot, bounded SQL injection, and out-of-band SSRF confirmed by a callback to our own collector
- Every Deep finding carries a reproducible proof, not an inference
- Authenticated scanning — store a session and we test the pages behind your login, where the vulnerabilities that matter usually live
- A headless browser crawls your single-page app, so React and Vue routes are tested rather than one empty shell
- Daily re-test — you hear about a change the day it appears

### Business — $399 per month
- Best for: When you want what a manual pentest does, continuously.
- Adds: The full penetration test
- Assets: up to 30 verified assets · Depth: Deep + pentest · Cadence: Daily re-test
- Everything in Growth
- The full penetration test: real attack payloads for path traversal, OS-command injection, server-side template injection, XXE, XPath, open redirect and CRLF — the classes an automated scanner usually skips
- Object-level authorization testing (IDOR/BOLA) and mass-assignment probes against your API's own schema
- WAF effectiveness report — how many attack classes your edge actually blocked, measured rather than assumed
- Priority support

### One-off pentest report — $99 (one-off)
- Best for: You need one report, by a date, and not a subscription.
- Adds: A single full pentest and its report
- Assets: 1 verified asset · Depth: Deep + pentest · Cadence: One scan
- One full penetration test of one asset — everything Business runs, once
- The complete written report with evidence, proofs and fix guidance
- The questionnaire pack and compliance mapping
- No subscription, no renewal, no card kept on file

## Frequently asked questions

### How is this different from a vulnerability scanner?
A scanner reports what it can see and leaves you to work out what it means — which is why a typical report runs to hundreds of entries, most of which are not reachable, not exploitable, or already mitigated somewhere else in your stack. SecQon takes each candidate finding and tests the claim: is this actually reachable, does the affected path exist, does the evidence hold together. Findings arrive labelled confirmed, likely or unconfirmed, with the evidence attached, so triage is a decision rather than an investigation.

### Is this a real penetration test, or an automated scan?
It is automated external testing with a validation layer, and we describe it that way deliberately. It covers a good deal of the ground an external pentest covers — security headers and cookie flags, TLS and certificate posture, deprecated TLS versions, DNS and email spoofing (SPF, DMARC, CAA, DNSSEC), exposed services and open ports, technology fingerprinting, exposed version-control and build files, CORS policy, unencoded reflection of request input, third-party scripts loaded without integrity pinning, and template-driven checks for known-vulnerable software — and it produces the same class of report. That reaches six of the OWASP Top 10 categories with a purpose-built test — A01, A02, A03, A05, A06 and A08 — plus A07 only where a template recognises a service still answering on its shipped default credentials. We do not claim the other three, and every report names them on its face: A04 (Insecure Design) and A09 (Logging and Monitoring Failures) are not observable from outside at all, and A10 (SSRF) is confirmed out-of-band — the proof is your server calling a collector we run, which is never visible in a response, so it is a Deep-profile check and a report from any other profile states that SSRF was not assessed. What it is not is a human red-teamer chasing business-logic flaws, and no automated product should claim otherwise. Many teams use SecQon continuously and still commission a human pentest once a year.

### Can you test anything I point you at?
No, and that is deliberate. Every asset must be verified as yours by a DNS TXT record, a hosted file, or a meta tag before a single request is sent. Unverified assets cannot be scanned at all. The one exception is the free exposure check on this page, which is strictly passive — a DNS lookup, a TLS handshake and an ordinary HTTPS GET — and sends no more traffic than a visitor loading your homepage.

### Will scanning break my production site?
The engine is bounded and non-destructive by design. It runs no exploit payloads that change state, is rate-limited per host, refuses anything resolving to a private or reserved address, and holds to the scope you verified — no wandering onto a neighbouring host. Validation confirms a finding is reachable; it does not prove it by exploiting it.

### What do the reports actually contain?
Every finding about your site carries a severity, an exploitability verdict, the evidence behind it, a plain-English explanation of the risk, and specific remediation — plus a CVSS score wherever the source that produced the finding publishes one. Findings are mapped to OWASP Top 10 categories and SOC 2 Trust Services criteria wherever they apply, so the report can go straight to an auditor or a customer's security team. Reports export as PDF and can be shared through a link.

### How long until I see my first result?
Adding a domain and publishing the verification record takes a few minutes; DNS propagation is usually the longest part. Once an asset is verified you can launch a scan immediately, and results land in hours rather than the weeks a scheduled engagement takes.

### Where does my data go, and what does the AI see?
Everything runs on Google Cloud in asia-south1 (Mumbai), and your findings and their evidence live in that database. The model is Gemini on Vertex AI in the same region, and it sees only normalised finding fields and short evidence snippets that have been minimised and then redacted — secrets, tokens and personal data are stripped in the pipeline rather than trusted to a prompt, and credentials you give us for authenticated scanning are encrypted at rest and never enter a prompt at all. On the Free plan and on a Light scan no model is called. Findings, evidence and reports belong to your tenant and are never used to train a model. Authorisation events — agreements accepted, assets verified, scans attested, scope refusals, share links issued — are written to an append-only, hash-chained log. The full account is at secqon.com/legal/privacy.

### What happens when I hit the limits of the free tier?
Nothing breaks. The free tier covers one verified asset with monthly re-testing, indefinitely, with no card on file. What Free gives you is the passive check set; paying is what buys the full one, more assets and faster monitoring — and if you never upgrade, that free asset keeps being tested.

## Key pages

- https://secqon.com/ — overview
- https://secqon.com/pricing — full pricing and feature comparison
- https://secqon.com/how-it-works — the method, step by step, with its limits
- https://secqon.com/owasp-top-10 — category-by-category coverage
- https://secqon.com/docs — REST API documentation
- https://secqon.com/legal — terms, privacy, rules of engagement
- https://api.secqon.com/openapi.json — OpenAPI 3 specification

## Contact

- Support: support@secqon.com
- Sales: sales@secqon.com