Coming soon. The verified active scan is not sold yet: it opens workspace by workspace. You can ask for early access now. This article explains how it will work, so you can prepare.

The passive audit only reads what your domain shows the world. The verified active scan goes one step further: with an authorization you sign, our dedicated scanner sends real test requests to the web applications you choose (Nuclei, then OWASP ZAP), signed in with a test account if you wish, and tells you which suspicions of the audit are confirmed and which are not. The active scan page describes it in detail.

Before you start

The domain must be proven with its TXT record. A domain in preview cannot be scanned actively.
Only owners and admins of the workspace can sign an authorization. Members can start a scan once an authorization is in force; viewers cannot.
Prepare a test account if you want to test behind the login: an account created for this, with no real customers’ data, never a production administrator.
Tell your host or your security team before the first scan if they watch for attacks. The requests come from one published address, with the user agent PerimetryActive/1.0.
For a client’s site, get your client’s written agreement before you sign.

Sign an authorization

Open the domain and press Open the active scan, then Sign an authorization.
Confirm it is you with your password or a passkey.
Choose the hosts: the domain and up to 20 of its subdomains, never an IP address or another domain. Each host is shown with the addresses it points to: by signing, you confirm that the servers at these addresses may be tested too (yours, or run for you).
Add the paths never to request, one per line, starting with /. Sign-out, deletion, payment and password-change pages are always left out anyway.
Choose the engines (Nuclei, ZAP or both) and the rate, from 1 to 20 requests per second.
Set the window: the first and last day (90 days at most), the days of the week, the hours and the time zone.
If you wish, add the test account: a header (bearer token or session cookie) or a login form with its address, its fields and a sign that you are signed in.
Enter your name, your role and your organisation, read the authorization text, tick the box and press Sign the authorization.

The exact text you signed is kept with its version and its fingerprint, and the signature is recorded in the activity log.

Start a scan

Press Start an active scan. Inside the window, the scan starts within a minute; outside it, the scan waits for the window to open. A scan lasts 4 hours at most. You can run 3 scans per domain per day; the option includes 4 full scans a month per domain.

You can stop a scan at any time from its page.

Read the results

Each finding shows the engine that found it, its severity, the address concerned and short evidence. Cookies, tokens, passwords, e-mail addresses and your test account are removed from the evidence before it is stored.

Below the findings, the findings of the last passive audit are matched with the scan:

Confirmed: the active test reproduced it. Fix it first.
Not reproduced: the test did not trigger it. It may be blocked by a firewall or a patch; check before you accept the risk.
Not tested: no test of the scan covered it.

Revoke an authorization

Press Revoke on the authorization. A scan in progress stops within a few minutes, and the test-account credentials are deleted. An authorization also ends by itself at the end of its window, after 90 days at most, or when the domain is no longer proven.

What the scan never does

It never tries to bring a service down, never guesses passwords and never takes destructive actions. It only connects to the hosts and the addresses you signed for, on ports 80, 443, 8080 and 8443, never to private or reserved addresses, and it stops by itself if it loses contact with the application for 5 minutes.

Price

€49 a month per domain without VAT (€490 a year), from the Solo plan. Agency includes 1 domain and Agency Plus 3. It is not available on Free. Up to 20 hosts and 4 full scans a month per domain.