SecTepe SnapScan– vulnerability scanner and attack surface platform
SnapScan shows what attackers can see of your company. It tests domains, web apps, APIs, cloud accounts and internal networks. Every finding comes with evidence and remediation advice. We built SnapScan ourselves and run it self-hosted.
Request a demoAt a glance
- Vulnerability scanning and web recon
- External attack surface management with change detection
- API tests and authenticated DAST
- Cloud and Kubernetes posture
- AI-assisted pentest
- Mapping to BSI IT-Grundschutz and ISO 27001
Two ways to use SnapScan
SnapScan comes in two forms. Both use the same scan engines and the same data model.
Self-service scan
You enter your name, email and domain and prove that you are authorized. The website security check then runs on its own. You get a white-label report with an executive summary, a risk rating, CVE and CWE references and remediation advice. An email tells you when it is ready.
Multi-tenant platform
For security teams and service providers: an operator console with roles (viewer, operator, admin, owner), engagements, asset inventory, scheduled scans and finding management. Each tenant has its own kill switch that stops all new scans and running operations.
Scan engines
You pick one engine per scan. They range from a passive outside view to a targeted retest of a single finding.
Passive and OSINT
A non-intrusive snapshot of what is publicly visible. It only sees what a browser would see anyway.
Vulnerability scan
A full run over known vulnerability signatures of all severities, without active attacks.
Web recon
Find subdomains, web services and open ports. Three depths: fast in minutes, normal, or deep with active tests.
API and authenticated DAST
Check headers, CORS, cookie flags and exposed API descriptions. With a login, SnapScan also tests access control and CSRF, only inside an engagement.
Cloud and Kubernetes
From outside: open buckets, dangling DNS records, subdomain takeover. From inside: AWS, Azure and GCP accounts and Kubernetes clusters against CIS catalogs, read-only.
AI-assisted pentest
An AI agent explores, forms hypotheses and documents how findings connect. It can be combined with web recon.
Retest
One click retests a single finding. The result is: still present, not observed, or inconclusive.
Internal runners
A runner inside the customer network, as a Docker image or hardened appliance. It gets a signed scope and rejects targets outside of it locally.
On-host agent
A local language model suggests next steps on a host. Nothing runs unless a person approves each command in the console.
Findings you can work with
Each finding is its own record with severity, CVE and CVSS, host and status. The status moves from open to verified, then to remediated, accepted or false positive. Repeated scans do not create duplicates. SnapScan tracks when a finding was first and last seen.
- Evidence as a hashed artifact, such as a detection line, transcript or screenshot
- CISA KEV and EPSS enrichment, so you fix what is actually being exploited first
- Change detection: a diff of what changed on your attack surface between two scans
- Security rating and exposure score per target
- Scheduled rescans from every hour to every 90 days, weekly by default
This turns a single scan into ongoingattack surface management. Our post onCTEM in SnapScanexplains how the loop of discovering, validating and prioritizing works.
Compliance mapping to BSI and ISO 27001
SnapScan maps each finding, by its category, to modules ofBSI IT-Grundschutz and controls fromISO/IEC 27001:2022 Annex A. A SQL injection maps to APP.3.1 (web applications) and A.8.26, for example. An outdated component maps to OPS.1.1.3 (patch and change management) and A.8.8.
Your results speak the language of your ISMS and your audits. The mapping guides prioritization and evidence. It is not a formal certification statement.
Authorization before automation
SnapScan only scans targets you are authorized to test. In the self-service scan, that means a matching email domain or a DNS TXT record. On the platform, an engagement wraps every operation. It defines:
- Scope from external domains, internal network ranges and excluded hosts
- Rules of engagement, such as the maximum intensity
- Time window and contract reference of the assignment
- A kill switch for emergencies and an append-only audit trail
Active verification of vulnerabilities is off by default. It only runs if the engagement explicitly allows it (opt-in), and it is staged. The mildest level proves a flaw without running any command. Further levels need a second opt-in. Read more in our post onactive exploitation and rapid response.
Legal note: Scans and pentests only run with permission from the owner of the systems being tested. Scanning other people's systems without permission can be a criminal offense.
Integrations
- SARIF 2.1.0 for GitHub code scanning and Azure DevOps
- MCP server (read-only) for SOAR, ticketing and AI agents, with KEV, EPSS and a proof flag per finding. See MCP findings export
- Rapid response: when a new critical CVE appears, one call retests every target of an engagement for it
- Reports as white-label HTML and Markdown, email notifications
Data sovereignty
- EU-sovereign and self-hosted
- Run by us or on your side, as a container or appliance
- Credentials encrypted (AES-256-GCM)
- Offline licenses for self-hosted runners and appliances
SnapScan and our pentest services
An automated pentest does not replace a manual one. Business logic and creative attack paths need people. That is why we combine both: classicpenetration testsby our analysts, andPentest as a Serviceon SnapScan in between. Our post onin-network runners and the applianceshows how internal tests work.
SnapScan FAQ
- Can I scan any domain with SnapScan?
- No. You can only scan domains you are authorized to test. The self-service scan checks this before it starts. If your email domain matches the target domain (no freemail addresses), the scan starts right away. Otherwise you prove ownership with a DNS TXT record. On the platform, an engagement defines which targets are allowed and in which time window. SnapScan rejects everything outside of it.
- What is the difference between a vulnerability scan and a pentest?
- A vulnerability scan looks for known flaws and misconfigurations automatically. A pentest goes further: it checks whether flaws can actually be exploited and chained. SnapScan covers both, from passive scans to AI-assisted pentests. It does not replace a manual penetration test by our analysts. It fills the gaps between those tests.
- Does SnapScan actively exploit vulnerabilities?
- Not by default. Active verification only runs when the engagement explicitly allows it. It is staged: the mildest level proves a flaw without running any command, and further levels need a second opt-in. Every attempt is logged, and a kill switch stops running work at once.
- Where is my data stored?
- SnapScan is self-hosted. We run the platform ourselves, or you run it on your side as a container or hardened appliance. Credentials for cloud, Kubernetes and DAST scans are encrypted (AES-256-GCM).
- Does SnapScan help with ISO 27001 and BSI IT-Grundschutz?
- Yes, as a source of evidence. SnapScan maps findings to BSI IT-Grundschutz modules and ISO/IEC 27001:2022 Annex A controls. The mapping guides prioritization and ISMS documentation. It is not a certification statement.
- How do I get access?
- Get in touch. We will show you SnapScan in a demo and help you decide whether the self-service scan, the platform or our managed Pentest as a Service fits you best.
See SnapScan live
We show you a scan on a sample target and help you choose the right starting point.
How we work with you
We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.
1. Free initial conversation
We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.
2. Structured assessment
We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.
3. Delivery with a dedicated lead
An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.
4. Continuous operations & review
After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.