Is an active scan legal?

Testing a system without its owner’s permission can be an offence in many countries. That is why the scan only runs on a domain you have proven, after an authorization signed by an owner or admin who declares they are entitled to give it, and only against the addresses shown to them. For a client’s site, get your client’s written agreement before you sign.

Will it slow down or break my site?

The rate is yours to choose, from 1 to 20 requests per second (5 by default), within the hours you choose. Destructive tests are excluded, and so are sign-out, deletion and payment pages. Run the first scan outside busy hours, or on a staging copy, if your site is fragile.

Should I warn my host or my security team?

Yes, before the first scan if they watch for attacks: the requests come from one published address with the user agent PerimetryActive/1.0, so they can recognise them.

What happens to the test account?

Its credentials are encrypted, sent only to the scanner for that scan, and deleted when the scan ends and when the authorization ends. Use an account created for testing, never a production administrator.

How is it different from Detectify, Intruder or HostedScan?

Those tools sell active scanning as their core product; their plans with signed-in scans start around €100 a month, and some are sold on a quote. Ours starts from the passive audit you already have: it checks what the audit suspects, includes signed-in scans from the start, and has a public price per domain.

It opens workspace by workspace. Ask for early access now: tell us your domain and your plan, and we will tell you when your workspace can use it. Nothing is charged before then.

Coming soon · option per domain

Verified active scan: confirm what the audit suspects

The passive audit reads what your domain shows the world. The active scan goes one step further: with your signed authorization, our dedicated scanner sends real test requests to the web applications you choose, signed in with a test account if you wish, and tells you which suspicions are confirmed, which are not reproduced, and what else it found.

€49 a month per domain, excl. VAT · €490 a yearFrom the Solo plan · 1 domain included on Agency, 3 on Agency Plus

Request early access See the pricing

The passive audit and the active scan

They answer different questions. The audit watches every domain all the time without touching anything; the active scan tests a few applications, on the dates you set, to know for sure.

	Passive audit (every plan)	Verified active scan (option)
What it sends	Ordinary requests, like a visitor: DNS queries, a home page, a TLS handshake	Test requests built to trigger weaknesses, at the rate you allow
Permission	Nothing to sign: it only reads what is public	An authorization signed in the application, for a domain you have proven
How often	Every week or every day, on every domain	When you start it, inside your window: 4 full scans a month per domain
What it finds	Configuration of DNS, e-mail, certificates, headers, exposure seen from public sources	Known vulnerabilities, exposed panels and files, injection and cross-site scripting flaws, behind the login too
What you get	Findings, a score and the fix for each	Each suspicion of the audit confirmed or not reproduced, with short evidence

How it works

Prove the domain
The active scan only runs on a domain whose ownership you have proven with a TXT record, the same proof the audit uses.
Sign the authorization
An owner or an admin of the workspace chooses the hosts (up to 20, the domain and its subdomains, never an IP address or another domain), the paths never to request, the engines, the rate (1 to 20 requests per second), the window (days, hours, time zone, 90 days at most) and, if wished, a test account. Each host is shown with the addresses it points to; the signer confirms them too. Signing asks for your password or a passkey again, and the exact text signed is kept with its fingerprint.
The scanner tests
Our dedicated scanner, on a server of its own with one published address, runs Nuclei and then OWASP ZAP. It only connects to the hosts and the addresses you signed for, at the rate you set, and stops at the end of the window.
You read the results
Each finding comes with its severity, the address concerned and short evidence with cookies, tokens, passwords and e-mail addresses removed. The findings of the passive audit are marked confirmed, not reproduced or not tested, so you fix what is real first.

What it tests

Targeted checks (Nuclei)

Templates for known vulnerabilities (CVE), misconfigurations, exposed files and admin panels, and the technologies in use, chosen from what the passive audit found. Templates that guess passwords, try default logins, fuzz or could disrupt a service are left out.

Crawl and active scan (OWASP ZAP)

ZAP explores the application, analyses every page it sees, then runs its active scan at medium strength: injection (SQL, commands), cross-site scripting, path traversal, server misconfigurations and more. Rules that could crash a service are switched off.

Behind the login

Give a test account, as a header (bearer token or session cookie) or a login form, and the scan covers the pages only signed-in users see. ZAP uses the login form; Nuclei uses the header.

Tested, never broken

An active scan must never become an incident. These safeguards are built into the scanner, not left to good intentions.

Only the hosts and addresses you signed for, on ports 80, 443, 8080 and 8443; private and reserved addresses are always refused
Never denial of service, password guessing or destructive actions
Sign-out, deletion, payment and password-change pages are always left out, plus the paths you add
Your window and your rate, 1 to 20 requests per second; 4 hours at most per scan, 3 scans per domain per day at most
Revocable at any time: a scan in progress stops within minutes, and stops by itself if it loses contact with the application
Test-account credentials encrypted, sent only to the scanner, deleted at the end of the scan and when the authorization ends
Every signature, start, stop and revocation recorded in the activity log

Coming soon

Price

An option per domain, with a public price, in euros, without a quote.

€49 a month per domain, excl. VAT

or €490 a year

Up to 20 hosts of the domain
4 full scans a month
Signed-in scans
Matched with the passive audit

Free	Not available
Solo	Option, €49 per domain
Agency	1 domain included, then €49 per domain
Agency Plus	3 domains included, then €49 per domain

Not sold yet: it opens workspace by workspace. Ask for early access with your domain and your plan; we answer within two working days.

Request early access

What it does not replace

A penetration test

A person who understands your business finds flaws no scanner sees: access rules, payment logic, chains of small weaknesses. Keep a yearly test by a qualified firm if you handle sensitive data.

Testing what you do not own

Third-party services, other domains and IP addresses outside your signed scope are never tested. A host that starts pointing elsewhere after the signature is refused.

Every page of a large application

A scan lasts 4 hours at most and follows the links it finds. Pages that need a particular path through the application may not be reached.

Questions

Is an active scan legal?: Testing a system without its owner’s permission can be an offence in many countries. That is why the scan only runs on a domain you have proven, after an authorization signed by an owner or admin who declares they are entitled to give it, and only against the addresses shown to them. For a client’s site, get your client’s written agreement before you sign.
Will it slow down or break my site?: The rate is yours to choose, from 1 to 20 requests per second (5 by default), within the hours you choose. Destructive tests are excluded, and so are sign-out, deletion and payment pages. Run the first scan outside busy hours, or on a staging copy, if your site is fragile.
Should I warn my host or my security team?: Yes, before the first scan if they watch for attacks: the requests come from one published address with the user agent PerimetryActive/1.0, so they can recognise them.
What happens to the test account?: Its credentials are encrypted, sent only to the scanner for that scan, and deleted when the scan ends and when the authorization ends. Use an account created for testing, never a production administrator.
How is it different from Detectify, Intruder or HostedScan?: Those tools sell active scanning as their core product; their plans with signed-in scans start around €100 a month, and some are sold on a quote. Ours starts from the passive audit you already have: it checks what the audit suspects, includes signed-in scans from the start, and has a public price per domain.
When can I use it?: It opens workspace by workspace. Ask for early access now: tell us your domain and your plan, and we will tell you when your workspace can use it. Nothing is charged before then.

Want it on your domains?

Ask for early access, or start with the free passive audit today.

Request early access Start free