We run the scans.
Scope, profiles, and schedule are agreed once. From then on, assessments run on time and every run is recorded, including the ones that didn’t finish.
CONTINUOUS VULNERABILITY SCANNING · AUDIT-READY
Scans on schedule.
Fixes you can prove.
Daily, weekly, monthly, or quarterly assessments of your web
applications and the services behind them. Every scan, finding,
and fix on record, ready for your ISO 27001 or SOC 2 auditor.
✓ We run the scans. Your team works the dashboard.
ON SCHEDULE. ON RECORD.
Recurring scansDaily to quarterly
✓Audit evidenceEvery fix on record
✓ Scans on your schedule
Evidence your auditor can review
Fixes tracked to closure
No platform to run
BUILT FOR SMALL SECURITY TEAMS
You are the security team.
We’re the part you don’t have time to build.
No scanners to tune, no infrastructure to maintain, and no reports to piece together the week before the audit.
You work one list.
What’s new, what’s overdue, what to fix first, and roughly how much effort it takes. One dashboard, prioritised by severity and grouped by fix.
The audit is already prepared.
Scan history, time to fix, SLA adherence, and accepted risks are there when the auditor asks. Export the report and move on.
YOUR SECURITY, IN FOCUS
One workspace.
Everything you need to act on.
Every asset, every finding, every deadline.
The numbers your team works from are the
same numbers your auditor reviews.
Exposure overview
Your application security, at a glance.
Latest assessment completedProduction web app · Completed just now
View scan ↗Critical / High3 ↓ 4
Prioritize these findings
Open findings12
Across your applications
Verified resolved28 ↑ 8
Progress you can measure
Execution coverage24 /24
Completed executions
Time to fix · Critical / High6days
Median, first detection to resolved
SLA adherence96%
Fixed within agreed deadlines
Oldest open finding21days
Medium · within SLA
Risk accepted2
With a reason and an owner
Needs your attention View all ↗
SQL injectionapp.example.com / api / users
Critical↗Cross-site scripting (XSS)app.example.com / search
High↗Missing access controlapp.example.com / admin
High↗Exposure over time ● Open findings
40200
Scan 1Scan 4Latest scan
↘ Less exposure. Measurable progress.
Findings, time to fix, SLA adherence, exceptions, and scan history in one workspace.
BUILT FOR THE AUDIT
The questions your auditor asks.
Answered before they ask.
ISO 27001 and SOC 2 auditors don’t want a single scan. They want to see a process that runs, and proof that it works.
| THE AUDITOR ASKS | WHAT AUDITON SHOWS |
|---|---|
| “Show me your vulnerability management process.”ISO 27001 A.8.8 · SOC 2 CC7.1 | Recurring assessments on an agreed schedule, with a complete scan history. Partial, failed, and timed-out runs are recorded, not hidden. |
| “How do you know what was tested?”ISO 27001 A.8.8 · CLAUSE 9.1 | Execution coverage in every report: each tool and stage marked completed, skipped, partial, failed, or timed out, with the reason. |
| “Show me that findings get fixed on time.”ISO 27001 A.8.8 · SOC 2 CC7.1 | Time to fix and SLA adherence by severity, and the age of every open finding, measured from first detection to resolution. |
| “What about the ones you didn’t fix?”ISO 27001 clause 6.1.3 · A.8.8 | Risk-accepted exceptions, each with a recorded reason and an owner, kept separate from open findings. |
| “How do you decide what to fix first?”ISO 27001 A.8.8 | Severity with CVSS 3.1, CWE, OWASP, PCI DSS 4.0, and ISO 27001 references per finding, and a remediation plan grouped by fix with effort estimates. |
| “Is your exposure getting better or worse?”ISO 27001 clause 9.1 | Drift between assessments: what’s new, what persists, and what’s resolved, with an exposure trend over time. |
Control references show where Auditon’s output is typically used as evidence. They are mappings, not compliance attestations: your auditor decides what satisfies a control. Auditon is not a PCI Approved Scanning Vendor (ASV) and does not replace an annual penetration test. More on ISO 27001 vulnerability scanning →
PICK YOUR RHYTHM
A schedule that fits your releases.
And your audit.
The audit baseline.
A documented, repeatable assessment every quarter. The minimum most ISO 27001 programmes and customer questionnaires expect.
For teams shipping regularly.
Catch what each month of releases introduced, and keep time-to-fix numbers you’re comfortable showing.
For fast-moving products.
New exposure found within days, not quarters. Drift stays small and easy to work through.
For internet-facing APIs.
Critical services checked every day, so a misconfigured deploy doesn’t wait for the next review.
Cadence is agreed during setup and can differ per asset: daily for your public API, quarterly for the marketing site. Change it as you grow.
Discuss your scheduleTHE DETAIL MAKES THE DIFFERENCE
A finding is only the start.
The detail gets it fixed.
See what a scan actually delivers. Clear priorities, the context behind each finding, and practical next steps your team can work from.
- 01Know what needs attention
Severity and affected assets, in one view.
- 02See what supports the finding
Evidence and confidence, with limitations made clear.
- 03Give your team a next step
Remediation guidance with compliance references to OWASP, PCI DSS and ISO 27001.
Assessment report
SECURITY ASSESSMENT
Security assessment
4 assets · 16 findings · 22 of 31 checks
0Critical
0High
2Medium
10Low
4Info
FINDING 07 / 16Low
Content Security Policy (CSP) header missing
https://app.example.com/Understand the risk
CSP limits which scripts a browser will run on the page. Without it, any cross-site scripting flaw is easier to exploit. Its absence is a missing defence-in-depth layer, not a vulnerability by itself.
Know what was observed
The captured response had no Content-Security-Policy header. Selected response fields are shown in the full finding; raw request and response data is withheld.
CSP_MISSINGObserved by the HTTP header check. Not independently verified.
Turn the finding into a next step
Start with a restrictive policy and relax as needed. Use report-only mode first to identify issues before enforcing.
Actionable guidance from the assessment.
EXPLORE THE COVERAGE
From the application
to the services behind it.
Explore the checks available for your assessment.
Coverage is tailored to your scope, services,
and the access you provide.
Web discovery & crawlingFind the application surfaces to assess.
- HTTP and HTTPS service discovery on scanned ports
- Traditional web crawling and URL inventory
- Firefox / AJAX crawling for JavaScript-driven pages
- Directory and file discovery with ffuf
- Discovered URLs and crawl-stage coverage in reports
Crawling stays within the approved origin and configured depth and time limits.
Application vulnerability checksExamine behavior and security controls.
- ZAP passive analysis and configurable active scanning
- Reflected cross-site scripting (XSS) and SQL injection rules
- Option to enable all installed ZAP active scanners
- Nuclei template-based vulnerability checks
- HTTP security headers, including HSTS and CSP
Active checks depend on the agreed profile. Installed rules and templates run where applicable, within scan budgets.
Authenticated & API assessmentReach the areas that need supplied access.
- Authenticated scanning with a supplied bearer token or cookie
- Session checks before crawling, before active testing, and at completion
- Logout links skipped, so the session lasts the whole scan
- Tokens and cookies encrypted at rest and never shown again after entry
- API discovery from a supplied OpenAPI 3.0 JSON specification
- Requests restricted to the approved application origin
- Explicit service credential checks with supplied username/password lists
Sessions must stay valid for the scan; if one stops working, the web results say so instead of reporting a clean scan. Credential checks require an agreed host, port, and service, with up to 25 combinations per check.
Network & service assessmentUnderstand what is listening behind the app.
- TCP port discovery across a configured range, up to 1-65535
- Service identification and optional Nmap default scripts
- Service-driven SSH and SMB probes
- Kubernetes service probes
- Datastore service probes
- Version-based CVE lookup
Service probes depend on what is discovered. Open ports are inventory; version-based CVE matches remain candidates for verification.
Certificates & TLSInspect the controls protecting data in transit.
- Certificate and trust-chain checks
- TLS protocol and cipher configuration analysis
- Extended TLS assessment with testssl
- Reported TLS grades and certificate trust observations
- Affected TLS endpoints and remediation guidance
TLS checks run against applicable services. The report records findings and the completion state of each stage.
Domain & UDP checksExtend the assessment where the scope allows.
- Certificate Transparency lookup for domain targets
- Domain mail-security posture checks
- Targeted UDP SNMP probes
- UDP amplification probes
Domain checks need a hostname. CT names do not automatically become targets; UDP checks are explicitly enabled probes, not a full UDP-port sweep.
Reports & client workspaceTurn the assessment into a clear next step.
- Client-scoped overview, assets, findings, scans, and reports
- Finding search, filters, detail views, and scan history
- Executive risk summary and prioritized remediation
- Descriptions, impact, affected locations, and remediation guidance
- Structured evidence and scanner confidence where supplied
- CVE, CWE and CVSS references, mapped to OWASP, PCI DSS 4.0 and ISO 27001 Annex A where available
- Downloadable HTML reports with detailed execution coverage
- Prioritised remediation plan grouped by fix
Scanner confidence and independent verification are separate. Framework references are mappings, not compliance attestations.
Scope, profiles & scan visibilityKnow what ran and how far it got.
- Configured targets, approved IPv4 destinations, and port ranges
- Reusable scan profiles with independently enabled stages
- Configurable tool deadlines, crawl limits, and active-request controls
- Operator-managed scan launch, stop, and run history
- Configured recurring assessments
- Completed, skipped, partial, failed, and timed-out stage reporting
- Customer-specific workspace access and report exports
Schedule availability is agreed during setup. A partial scan or an absent finding does not establish that a vulnerability is resolved.
Every assessment shows its actual execution coverage. Available checks depend on the target, enabled profile, supplied inputs, and scan limits.
Discuss your scopeWhat needs extra setup, or is not currently included?
Authenticated scans need a valid session and a verification endpoint. API discovery accepts OpenAPI 3.0 JSON with operations on the approved origin. Domain and credential checks need the corresponding target information and supplied inputs.
Automatic form login, MFA handling, token renewal, multi-user authorization comparisons, business-logic testing, subpath scoping, and configurable path exclusions are not currently supported. The API adapter does not support YAML, Swagger 2, OpenAPI 3.1, or external references.
Independent cross-tool and automated out-of-band vulnerability verification, automatic fix verification, and PDF generation are not currently included.
AUDIT-READY. BUDGET-FRIENDLY.
Enterprise-grade evidence.
Without the enterprise bill.
From $250 per endpoint a month, billed annually: about 40% below what enterprise DAST is reported to cost for the same scope. Weekly scans, the client portal, reports, and API access for AI assistants are included. No platform licence, no scanner to staff.
Get an exact quote ↗Or start with a free 2-week trial ↗Prices in USD, excluding VAT. Minimum $350 a month. Daily scanning is quoted separately. Comparison based on reported Invicti Standard pricing of $4,000–6,000 per target a year (Vendr, February 2026); your own quote may differ.PER ENDPOINT, PER MONTH ↘
| Endpoints 1–5 | $250 |
| 6–10 | $125 |
| 11–25 | $60 |
| 26 and more | $30 |
Typical enterprise DAST, 5 endpoints ~$25,000 a year
auditon., 5 endpoints $15,000 a year
NEW · IN BETA
An infrastructure analyst
that runs inside your network.
A container we deploy beside your services, with troubleshooting tools we build around the systems you run, from firewalls and proxies to monitoring and CI/CD. It traces incidents across every layer, links them to the changes behind them, and forecasts trends heading for a limit. It uses your own OpenAI-compatible model endpoint.
A LITTLE MORE CLARITY
Good questions.
Straight answers.
What is Auditon?+
Auditon is a managed vulnerability scanning service for web applications and the services behind them. We run assessments on your schedule, from daily to quarterly, and publish every scan, finding, and fix to a client workspace your team works from and your auditor can review.
Can we try it first?+
Yes. The free 2-week trial covers up to three endpoints, each scanned three times, four days apart, with full reports and the client portal. No card is needed, and scans stop when the trial ends.
Will Auditon help with ISO 27001 or SOC 2?+
Auditon provides the operating evidence for vulnerability management controls such as ISO 27001:2022 Annex A 8.8 and SOC 2 CC7.1: a recurring scan history, execution coverage for every run, time to fix and SLA adherence by severity, and a record of risk-accepted exceptions. Framework references are mappings, not compliance attestations. Your auditor decides what satisfies a control.
Can we use it to answer customer security questionnaires?+
Yes. When a customer asks whether you perform regular vulnerability scanning, you can point to your schedule, your scan history, and how quickly you fix what is found, backed by downloadable reports.
Can our AI assistant read the results?+
Yes. Auditon has a read-only MCP endpoint, so Claude Code and other MCP-compatible agents can list your endpoints and findings, compare scans, and read full reports, including coverage gaps and items that still need verification. Each client creates its own revocable API keys in the portal. See how it works.
Is this a penetration test?+
No. Auditon is continuous, automated assessment run by us on an agreed schedule. It complements an annual penetration test: the pentest goes deep once a year, and Auditon watches for new exposure and tracks remediation in between.
We only have one security engineer. Is that enough?+
That is exactly who Auditon is built for. We configure and run the scans; your engineer works from one dashboard that shows what is new, what is overdue, what to fix first, and roughly how much effort it will take.
What happens after we fix something?+
The next assessment checks it again. Findings are tracked as new, persistent, or resolved across assessments, and time to fix is measured from first detection to resolution. A missing finding in a partial scan is never counted as resolved.
We already use a scanner. Can we compare?+
Yes. Share your current scope and a recent report, and we will compare coverage, reporting detail, and cost like for like. The decision stays yours. See how Auditon compares →
Can Auditon scan authenticated areas and APIs?+
Yes. Auditon can scan authenticated areas with a supplied bearer token or session cookie, and can discover API endpoints from an OpenAPI 3.0 JSON specification. Sessions are checked before crawling, before active testing, and at completion.
What vulnerabilities does Auditon check for?+
Checks include SQL injection, cross-site scripting (XSS), missing HTTP security headers such as HSTS and CSP, TLS and certificate issues, exposed services, and version-based CVE candidates. Coverage depends on your scope, enabled profile, and the access you provide.
LET’S TAKE A CLOSER LOOK
Walk into your next audit
with the evidence ready.
Tell us your scope and your audit date. We’ll take it from there.
Start a free 2-week trial ↗Prefer a call? Request a demo ↗Already a client? Open your workspace ↗