Priced per asset, published in full

Questions people ask before buying

How is this different from a vulnerability scanner?

A scanner reports what it can see and leaves you to work out what it means — which is why a typical report runs to hundreds of entries, most of which are not reachable, not exploitable, or already mitigated somewhere else in your stack. SecQon takes each candidate finding and tests the claim: is this actually reachable, does the affected path exist, does the evidence hold together. Findings arrive labelled confirmed, likely or unconfirmed, with the evidence attached, so triage is a decision rather than an investigation.

Is this a real penetration test, or an automated scan?

It is automated external testing with a validation layer, and we describe it that way deliberately. It covers a good deal of the ground an external pentest covers — security headers and cookie flags, TLS and certificate posture, deprecated TLS versions, DNS and email spoofing (SPF, DMARC, CAA, DNSSEC), exposed services and open ports, technology fingerprinting, exposed version-control and build files, CORS policy, unencoded reflection of request input, third-party scripts loaded without integrity pinning, and template-driven checks for known-vulnerable software — and it produces the same class of report. That reaches six of the OWASP Top 10 categories with a purpose-built test — A01, A02, A03, A05, A06 and A08 — plus A07 only where a template recognises a service still answering on its shipped default credentials. We do not claim the other three, and every report names them on its face: A04 (Insecure Design) and A09 (Logging and Monitoring Failures) are not observable from outside at all, and A10 (SSRF) is confirmed out-of-band — the proof is your server calling a collector we run, which is never visible in a response, so it is a Deep-profile check and a report from any other profile states that SSRF was not assessed. What it is not is a human red-teamer chasing business-logic flaws, and no automated product should claim otherwise. Many teams use SecQon continuously and still commission a human pentest once a year.

Can you test anything I point you at?

No, and that is deliberate. Every asset must be verified as yours by a DNS TXT record, a hosted file, or a meta tag before a single request is sent. Unverified assets cannot be scanned at all. The one exception is the free exposure check on this page, which is strictly passive — a DNS lookup, a TLS handshake and an ordinary HTTPS GET — and sends no more traffic than a visitor loading your homepage.

Will scanning break my production site?

The engine is bounded and non-destructive by design. It runs no exploit payloads that change state, is rate-limited per host, refuses anything resolving to a private or reserved address, and holds to the scope you verified — no wandering onto a neighbouring host. Validation confirms a finding is reachable; it does not prove it by exploiting it.

What do the reports actually contain?

Every finding about your site carries a severity, an exploitability verdict, the evidence behind it, a plain-English explanation of the risk, and specific remediation — plus a CVSS score wherever the source that produced the finding publishes one. Findings are mapped to OWASP Top 10 categories and SOC 2 Trust Services criteria wherever they apply, so the report can go straight to an auditor or a customer's security team. Reports export as PDF and can be shared through a link.

How long until I see my first result?

Adding a domain and publishing the verification record takes a few minutes; DNS propagation is usually the longest part. Once an asset is verified you can launch a scan immediately, and results land in hours rather than the weeks a scheduled engagement takes.

Where does my data go, and what does the AI see?

Everything runs on Google Cloud in asia-south1 (Mumbai), and your findings and their evidence live in that database. The model is Gemini on Vertex AI in the same region, and it sees only normalised finding fields and short evidence snippets that have been minimised and then redacted — secrets, tokens and personal data are stripped in the pipeline rather than trusted to a prompt, and credentials you give us for authenticated scanning are encrypted at rest and never enter a prompt at all. On the Free plan and on a Light scan no model is called. Findings, evidence and reports belong to your tenant and are never used to train a model. Authorisation events — agreements accepted, assets verified, scans attested, scope refusals, share links issued — are written to an append-only, hash-chained log. The full account is at secqon.com/legal/privacy.

What happens when I hit the limits of the free tier?

Nothing breaks. The free tier covers one verified asset with monthly re-testing, indefinitely, with no card on file. What Free gives you is the passive check set; paying is what buys the full one, more assets and faster monitoring — and if you never upgrade, that free asset keeps being tested.