You Already Own the Scanner. Sell What It Produces.

A Managed Scanning Service, Not a Scanner Login.

A customer given a scanner account will drown in output and blame whoever sold it to them. What they will pay for is the same output arriving on a schedule, filtered, merged, and with a person from your firm standing behind it.

• They ask, or it runs itselfA customer can request a scan from their own portal, or a cadence you set runs it for them daily, weekly, monthly or annually without anybody pressing anything.
• Your testers can run it for themYour own people can start a scan on behalf of any customer from the scanning area, which is the job rather than a customer convenience, and it skips the caps that exist to stop a customer spending your money.
• Everything is a setting you ownWho may start a scan, which scanners are offered, what is charged, where results land, which hours scanning is allowed in, and the authorisation wording. Each has a sensible default so it works before you have decided any of it.
• It switches off cleanlyScanning is a module. Off, it leaves the interface entirely for your team and your clients, and the templates you have built stay where they are.

Connect the Scanners You Already Pay For.

Fourteen integrations, configured in settings with only the fields that particular scanner actually needs. The credential is encrypted, stored with a column grant that keeps it out of every ordinary read, and shown back to you as nothing but its last four characters.

Two Ways to Reach a Scanner, and They Cost Different Things.

A consultancy asked to open its scanner to a shared cloud egress will refuse, and be right to. So there are two connection styles, and the platform states the cost of each rather than defaulting you into the convenient one.

• Scanning a client's internal estateThe same collector, owned by the customer instead of by you, runs inside their network. Internal systems are scanned from inside without a tunnel to anywhere, and there is no second protocol to learn.
• Self-hosted only, if that is your policyA switch that refuses any scanner whose results would pass through a third party, and every run records which of the two it used, so the answer to a customer's question is on the record rather than in somebody's memory.
• The token is shown onceA collector authenticates with a token generated in your browser and stored only as a hash. The screen says so at the moment it appears, because that is the only moment it can be copied.

Nothing Is Scanned That You Have Not Authorised.

Pointing a scanner at a host nobody approved is a criminal offence in most of the jurisdictions your clients operate in. That is a product problem, not a policy document, so the rules are enforced by the database rather than by the screen that happens to be open.

• Assets are approved by youEach authorised target carries who approved it, a reference for the paperwork behind it, and a date at each end. A start date in the future is exactly as unapproved as an expiry in the past, and one lapsed asset does not block a live one.
• Three policies for who may proposeOnly your firm adds targets, or a customer may propose one and wait for approval, or targets are open. The open setting names the legal risk next to itself, because a proposal that approves itself is precisely what the list exists to prevent.
• The authorisation is recorded on the runWhat was agreed, by whom, and when, stored on the scan itself rather than looked up later. You may reword your terms next month; the record has to say what was actually accepted at the time.
• Caps, cooldowns and hoursA monthly allowance and a minimum gap per customer, plus a window scanning is permitted in. A request outside the window is not refused, it is told when the window opens, which is the thing the person actually needs to know.
• One rule, asked everywhereThe button, the request and the scheduler all ask the same eligibility check, and it answers with a reason rather than a no.

A Cadence Is a Subscription on Your Own Stripe Account.

This is your revenue, not a share of ours. The frequency is the billing interval, the price is yours, and the money goes to your account without passing through us.

Results Worth Putting Your Name On.

Raw scanner output is twenty-nine findings that are really two issues across fourteen hosts. Handing that to a client is how a scanning service loses its customer in the second month.

1. 01Results are merged by title, so one weakness across forty hosts is one finding. Version numbers are deliberately never folded together, because two TLS versions are two different vulnerabilities and there is no undo for putting one under the other's heading.
2. 02Where the merge finds your library already has that write-up, your house wording wins. Otherwise the fullest description survives, and the worst severity and highest score are kept, because a merge must never quietly lower what a client is told.
3. 03Every affected host keeps its own evidence, in a table on the finding, so eleven merged hosts do not become eleven hosts and one screenshot.
4. 04The run can wait in a holding area for one of your people to read before the customer sees any of it, or go straight through, depending on what you are selling.
5. 05Whoever should be told is told, and when results are being held the audience is your firm rather than the customer. The email carries counts only; the findings stay behind a login.
6. 06The deliverable is a vulnerability report, with its own PDF and its own Word template, built in the report builder like every other document you send.

A Scan Result Is Not a Tested Finding.

Your firm sells the difference between those two things. A platform that blurs them is quietly devaluing the work your testers do, so this one keeps them apart by construction.

• Separate by defaultScan output lives in its own section of the engagement, staff-only, and is kept out of the penetration test report entirely rather than filtered out of it later.
• Promotion is deliberateMoving a scan result into your findings is an explicit action, and once moved it stops being a scan result, so the next import cannot overwrite the write-up a human just did.
• Honest about severityWhere a scanner asserts no severity, such as a port scan, nothing is invented. A column appears only when a result actually fills it.
• Two documents, two namesThe vulnerability report and the penetration test report are different templates with different defaults, so a client can always tell which they are holding.

Or Run It Yourself and Upload the File.

Plenty of firms will never connect a scanner and only ever want the output of the one they ran by hand on a phase. That path is first class, and it is the same merge, the same mapping and the same documents.

• Sixteen formatsNessus, Greenbone and OpenVAS, Burp, Nmap, ZAP in both its shapes, Nuclei, SARIF, Trivy, Acunetix, Qualys, Nikto, testssl.sh, Semgrep, Wapiti, CSV and generic JSON.
• Nothing is written until you have seen itThe count, the format it was recognised as, and the breakdown by severity appear before a single row is saved.
• Every field, and where it wentEach field the file carried is listed with a real sample beside it and what it fed. An unused one can be pointed at a field of yours, including your custom fields under the names you gave them.
• Remembered sensiblyField mappings are remembered per scanner, because a scanner emits the same fields whoever it was run against. The severity floor is remembered per client, because that genuinely is a per-customer decision.
• Where it landsImport from the scanning area, choosing the customer and then the engagement, and the results attach to the phase they belong to.