Skip to content
AINO Information

Services

Find it, prove it, fix it, and check that it stayed fixed.

Four services, one way of working: written authorization before any test, a person behind every reported finding, and a retest after you fix.

DAST · host scanning

Vulnerability scanning

Automated scanning of web applications and hosts, followed by manual validation of every reported issue. Web scanning covers the OWASP Top 10 classes such as injection, cross-site scripting and broken access control; host scanning covers known CVEs and insecure configuration.

How it runs

  • Scope and schedule agreed in writing, including excluded paths and test windows.
  • Authenticated and unauthenticated scans with WebInspect and host scanners.
  • Every finding is reproduced by hand; false positives are removed, not just flagged.
  • Retest after remediation, with a per-finding verdict.

What you get

A report with severity, evidence (request and response), remediation guidance, and a retest report that states which findings are verified fixed.

black · grey · white box

Penetration testing

Manual, attacker-perspective testing of web applications, APIs and internal or external networks. We chain findings the way an attacker would, to show real impact rather than a list of scanner hits.

How it runs

  • Rules of engagement signed before any traffic is sent: scope, test accounts, windows, emergency contacts.
  • Reconnaissance, vulnerability discovery, controlled exploitation and post-exploitation within the agreed limits.
  • Destructive actions, denial of service and data exfiltration are out of scope unless explicitly authorized.
  • Findings are reported as they are confirmed when severity is critical.

What you get

An executive summary, a technical report with reproduction steps and proof for each finding, prioritized remediation, and a retest.

SAST · SCA

Source code review

Static analysis of your application's source code and its open-source dependencies, with findings traced to the file and line. Review is run in our VAST platform on-premises or on your own environment, so source code does not leave your control.

How it runs

  • Fortify SCA for static analysis; Sonatype Nexus IQ for open-source component risk and licence compliance.
  • VAST's own AI-assisted scan for Java, C#, VB.NET and JSP, which needs no third-party scanner licence.
  • Each finding carries the data-flow path or code snippet that proves it; AI triage is advisory and cites what it read.
  • Fixed files are retested against the original scan to confirm the finding is gone.

What you get

A findings report in Fortify-compatible format, remediation guidance per language and framework, and a retest report.

advisory

Security consulting

Remediation guidance and secure-development support for engineering teams: helping developers understand a finding, choose the right fix, and avoid the same class of bug next time.

How it runs

  • Review of remediation plans and pull requests for reported findings.
  • Secure coding guidance for the frameworks you actually use.
  • Help setting up scanning in your pipeline so findings reach developers early.

What you get

Written guidance, working sessions with your team, and follow-up on open findings.

Engagement

How an engagement runs

  1. 01

    Scoping

    You tell us what to test and why. We propose scope, depth, schedule and what will be excluded.

  2. 02

    Written authorization

    A signed authorization letter and rules of engagement name the systems, the test window, the accounts we may use and the emergency contacts on both sides.

  3. 03

    Testing

    Work stays inside the authorized scope. Anything that could affect availability or data is agreed first.

  4. 04

    Manual validation

    Every reported finding is reproduced by a person. Scanner output alone is not a finding.

  5. 05

    Report

    Severity, evidence, impact and remediation for each finding, plus an executive summary.

  6. 06

    Retest

    After you fix, we recheck each finding and report which are verified fixed, which are not, and which could not be reached.

Rules of engagement

What we will and will not do

  • We test only systems the client has authorized in writing, and only within the agreed window.
  • Test data, credentials and findings are handled under the agreement and deleted at the agreed time after the engagement.
  • Critical findings are reported as soon as they are confirmed, not held for the final report.
  • If we discover a previously unknown vulnerability in a third-party product during an engagement, we tell the client first and coordinate disclosure with the vendor.

Found a security issue in something we built? See ourresponsible disclosure policy.