What does an internal vulnerability scan need on our side?

You need a runner inside your network. That is either a container on a Linux server or our ready-made appliance as a virtual machine. The runner opens the connection to the platform itself, from the inside out. You also need an active engagement.

Is an automated pentest the same as a manual one?

No. An automated pentest checks often and broadly. Business logic and creative attack paths still need people. We recommend both: manual penetration tests, and SnapScan for the time in between.

Can SnapScan cause damage in our network?

Active verification is off by default. It only runs when the engagement explicitly allows it. The mildest level proves a flaw without running any command. Further levels need a second opt-in. A kill switch stops everything at any time.

What happens when the time window ends?

The runner checks on a regular basis whether it may still work. If the engagement expires or someone hits the kill switch, it shuts itself down. SnapScan rejects operations outside the time window.

Back to SnapScan

SnapScan · Internal networks

Test your internal network, within clear limits

Many attacks start outside and end inside. One click on a phishing email is enough, and someone is in your network. SnapScan shows what they would find there. You decide exactly what gets tested and when.

Request a demo

Three ways into your internal network

The in-network runner

The runner is a small test agent inside your network. It runs as a container on a Linux server. It starts with a one-time key that expires after 24 hours. Then the runner receives a signed scope. It refuses targets outside that scope on its own, even if a command asks for them.

The hardened appliance

Don't want to maintain your own host? Then use the appliance. It is a ready-made virtual machine based on Ubuntu 24.04 LTS. It runs on common hypervisors. Every image is signed. Only SSH is open, and there is no web interface. Offline licenses are available for runners you operate yourself.

The on-host agent

Sometimes it is about a single server. That is where the on-host agent runs. A small language model on the host suggests next test steps. Nothing runs unless a person approves each command in the console. There is no autopilot. Every step goes into the audit trail.

The engagement sets the rules

An engagement is the frame for every test. Think of it as an order with clear limits. SnapScan checks these limits for every single target.

Scope: internal network ranges, external domains and excluded hosts.
Rules: for example the highest test intensity allowed.
Time window: start, end and the contract reference of the assignment.
Kill switch: an emergency stop that halts running work at once.
Audit trail: a log that can only be added to, never changed.

SnapScan rejects anything outside the scope or the time window.

Active tests only when you want them

A scan finds possible flaws. Only an active test shows whether a flaw can really be exploited. In SnapScan, this verification is off by default. You switch it on per engagement, on purpose.

The tests come in levels. The mildest level proves a flaw without running a command on the target. Further levels need a second opt-in. Checks around Active Directory also only run with explicit approval. Every attempt is logged.

Our article onin-network runners and the applianceshows how this works day to day. Rather not do it yourself? WithPentest as a Servicewe run SnapScan for you. For depth, there are ourmanual penetration tests.

Legal notice: Scans and pentests only take place with the permission of the owner of the systems tested. Testing other people's systems without permission may be a criminal offense.

FAQ on internal scans

What does an internal vulnerability scan need on our side?: You need a runner inside your network. That is either a container on a Linux server or our ready-made appliance as a virtual machine. The runner opens the connection to the platform itself, from the inside out. You also need an active engagement.
Is an automated pentest the same as a manual one?: No. An automated pentest checks often and broadly. Business logic and creative attack paths still need people. We recommend both: manual penetration tests, and SnapScan for the time in between.
Can SnapScan cause damage in our network?: Active verification is off by default. It only runs when the engagement explicitly allows it. The mildest level proves a flaw without running any command. Further levels need a second opt-in. A kill switch stops everything at any time.
What happens when the time window ends?: The runner checks on a regular basis whether it may still work. If the engagement expires or someone hits the kill switch, it shuts itself down. SnapScan rejects operations outside the time window.

Get your internal network tested

We will show you runner, engagement and kill switch in a demo. Then we plan the first run.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.