aegis // security scanning
Security findings you can trust.
Every one validated. Every one with evidence.
Aegis scans only what you are authorized to scan, guards every request against scope, and attaches the evidence behind every finding - with AI validation that suppresses noise (91% false-positive suppression on our labeled corpus, zero real findings lost).
how it works
The pipeline, end to end
01
Attest authorization
A scan refuses to start until a human attests the target is theirs to test. No attestation, no scan.
02
Map the surface
Subdomain recon, browser crawl, robots, sitemaps, and JS bundles - every request scope-checked.
03
Check, passively and actively
Header, cookie, CORS and TLS checks plus a curated safe-mode template corpus. No destructive tests, ever.
04
Validate with evidence
Each finding carries its request/response evidence and an AI verdict with confidence and a fix.
why aegis
Built for findings you can act on
Authorization-first
Targets are attested before anything runs - the scanner is designed to refuse unauthorized work.
Scope guard on every request
Decode-hardened URL canonicalization checks each request against your rules - encoded traversal tricks fail closed.
Evidence on every finding
The raw request and response behind every finding ship with it - no black-box verdicts.
AI verdicts with confidence + fix
91% false-positive suppression on our labeled corpus with zero real findings lost - measured, not claimed.
Re-scan re-validation
Fingerprinted findings re-validate across scans - unchanged verdicts come back without re-paying for LLM validation.
Exportable reports
Markdown and HTML reports on every scan, PDF wherever a browser is available - ready to hand to a client.
Self-hosted today. Hosted tiers at launch.
The full engine and dashboard are yours to run - cloud tiers follow.