No anonymous active scan
An unverified visitor remains limited to passive controls.
METHOD
A graduated, traceable and understandable security journey.
AxiSecurity does not run the same level of testing on an unknown domain, a verified domain and a formal penetration testing engagement.
✓ Authorised scope✓ Bounded tests✓ Actionable report✓ Retesting
The six-step journey
01
Public pre-check
Passive controls and public signal collection.
02
Account and asset
Create an isolated workspace and add the domain.
03
Validation
Prove control of the domain and attest the right to test.
04
Scan policy
The profile defines engines, intensity, quotas and exclusions.
05
Report
Normalisation, deduplication, scoring, evidence and remediation.
06
Retest & monitoring
Validate remediation and move to recurring monitoring if required.
Three structural safeguards
No pentest without mandate
DNS validation does not replace contractual authorisation.
No scanner inside the Web server
Engines are designed to run on workers isolated from the control plane.