Can I scan any domain with SnapScan?

No. You can only scan domains you are authorized to test. The self-service scan checks this before it starts. If your email domain matches the target domain (no freemail addresses), the scan starts right away. Otherwise you prove ownership with a DNS TXT record. On the platform, a job defines which targets are allowed and in which time window. SnapScan rejects everything outside of it.

What is the difference between a vulnerability scan and a pentest?

A vulnerability scan looks for known flaws and misconfigurations automatically. A pentest goes further: it checks whether flaws can actually be exploited and chained. SnapScan covers both, from passive scans to AI-assisted pentests. It does not replace a manual penetration test by our analysts. It fills the gaps between those tests.

Does SnapScan actively exploit vulnerabilities?

Not by default. Active verification only runs when the job explicitly allows it. It is staged: the mildest level proves a flaw without running any command, and further levels need a second opt-in. Every attempt is logged, and a kill switch stops running work at once.

Where is my data stored?

SnapScan is self-hosted. We run the platform ourselves, or you run it on your side as a container or hardened appliance. Credentials for cloud, Kubernetes and DAST scans are encrypted (AES-256-GCM).

Does SnapScan help with ISO 27001 and BSI IT-Grundschutz?

Yes, as a source of evidence. SnapScan maps findings to BSI IT-Grundschutz modules and ISO/IEC 27001:2022 Annex A controls. The mapping guides prioritization and ISMS documentation. It is not a certification statement.

Get in touch. We will show you SnapScan in a demo and help you decide whether the self-service scan, the platform or our managed Pentest as a Service fits you best.

Services

Vulnerability scanning · EASM · Pentest platform

SecTepe SnapScan– vulnerability scanner and attack surface platform

SnapScan shows what attackers can see of your company. It tests domains, websites, APIs, cloud accounts and internal networks. Each finding comes with proof and tips on how to fix it. We built SnapScan ourselves. It runs self-hosted on our own servers.

Request a demo

At a glance

Find flaws and map what is exposed
Watch your attack surface and see each change
Test APIs and web apps, also with a login
Check cloud and Kubernetes setups
Pentests with AI help
Links to BSI IT-Grundschutz and ISO 27001

Two ways to use SnapScan

SnapScan comes in two forms. Both run the same checks and store data the same way.

Self-service scan

You enter your name, email and domain. Then you show that you may test the domain. The check of your website runs on its own. You get a report in your own brand. It has a short summary for the boss, a risk rating, links to known flaws (CVE, CWE) and tips on how to fix them. An email tells you when it is ready.

Platform for many clients

For security teams and service providers. The console has four roles: viewer, operator, admin and owner. It also holds jobs, a list of all your systems, planned scans and your findings. Each client has its own kill switch. It stops all new scans and all work in progress.

Scan types

You pick one type per scan. They range from a quiet look from outside to a retest of a single finding.

Passive and OSINT

A look at what anyone can see in public. The scan does not touch your systems. It only sees what a browser would see.

Vulnerability scan

A full run over all known flaw patterns, from minor to critical. It does not launch real attacks.

Web recon

Finds subdomains, web services and open ports. There are three depths: fast in minutes, normal, or deep with active tests.

APIs and web apps with login

Checks headers, CORS, cookies and API docs left open. With a login, SnapScan also tests who may see what, and CSRF. This only runs inside a job.

Cloud and Kubernetes

From outside: open storage, stale DNS records and subdomains that others could take over. From inside: AWS, Azure and GCP accounts and Kubernetes, checked against CIS lists. SnapScan only reads and changes nothing.

Pentest with AI help

An AI agent looks around, makes guesses and notes how findings link up. You can run it together with web recon.

Retest

One click checks a single finding again. The result: still there, no longer seen, or not clear.

Runners in your network

A runner sits in your network, as a container or a ready, hardened box. It gets a signed list of allowed targets. It turns down all others on the spot.

Agent on the host

A local language model suggests next steps on a machine. Nothing runs until a person approves each step in the console.

Findings you can work with

Each finding is its own record. It has a severity, CVE and CVSS, the host and a status. The status goes from open to confirmed, then to fixed, accepted or false alarm. New scans do not create duplicates. SnapScan knows when it first and last saw a finding.

Proof with a checksum, such as the line that matched, a log or a screenshot
Data from CISA KEV and EPSS, so you first fix what attackers really use
Compare two scans: what changed on your attack surface?
A security grade and a risk score per target
Planned scans from every hour to every 90 days, weekly by default

This turns a single scan into ongoingattack surface management. Our post onCTEM in SnapScanshows how the loop of finding, checking and ranking works.

Links to BSI and ISO 27001

SnapScan links each finding, by its type, to modules ofBSI IT-Grundschutz. It also links it to controls fromISO/IEC 27001:2022 Annex A. A SQL injection maps to APP.3.1 (web apps) and A.8.26, for example. An old component maps to OPS.1.1.3 (patches and changes) and A.8.8.

So your results speak the language of your ISMS and your audits. The links help you rank work and show proof. They say nothing about whether you will get certified.

Permission first, then the scan

SnapScan only scans targets you may test. In the self-service scan, your email domain or a DNS TXT record shows this. On the platform, every check runs inside a job. The job sets:

which domains and internal networks are in, and which hosts are off limits
the rules, such as how hard the tests may push
the time window and the contract behind it
a kill switch and a log that can only grow, never change

Real attacks on flaws are off by default. They only run if the job clearly allows them (opt-in). There are levels. The mildest level proves a flaw without running any command. Each further level needs a second opt-in. Read more in our post onactive exploitation and rapid response.

Legal note: Scans and pentests only run with the owner's permission. Scanning other people's systems without permission can be a crime.

Links to your other tools

SARIF 2.1.0: findings show up in the code checks of common developer platforms
MCP server (read-only) for SOAR, tickets and AI agents. Each finding has KEV, EPSS and a proof flag. See MCP findings export
Rapid response: when a new critical CVE comes out, one call retests every target of a job for it
Reports in your own brand as HTML and Markdown, with email alerts

Your data stays yours

EU-sovereign and self-hosted
Run by us or on your side, as a container or a ready box
Logins stored encrypted (AES-256-GCM)
Licenses that work offline for your own runners and boxes

SnapScan and our pentests

A pentest by software does not replace one done by hand. Flaws in business logic and creative attack paths need people. That is why we use both. Our analysts run classicpenetration tests. In between, we runPentest as a Serviceon SnapScan. Our post onin-network runners and the applianceshows how tests inside your network work.

Features in detail

Attack surface management

Find what is exposed from outside. See each change and rank flaws by KEV and EPSS.

Vulnerability scanning

Test websites, APIs, cloud accounts and Kubernetes. With proof, retests and reports.

Internal networks

Runner, box and agent in your network. You set targets, time window and kill switch.

Compliance mapping

Link findings to BSI IT-Grundschutz and ISO 27001. With SARIF export and an MCP link.

SnapScan FAQ

Can I scan any domain with SnapScan?: No. You can only scan domains you are authorized to test. The self-service scan checks this before it starts. If your email domain matches the target domain (no freemail addresses), the scan starts right away. Otherwise you prove ownership with a DNS TXT record. On the platform, a job defines which targets are allowed and in which time window. SnapScan rejects everything outside of it.
What is the difference between a vulnerability scan and a pentest?: A vulnerability scan looks for known flaws and misconfigurations automatically. A pentest goes further: it checks whether flaws can actually be exploited and chained. SnapScan covers both, from passive scans to AI-assisted pentests. It does not replace a manual penetration test by our analysts. It fills the gaps between those tests.
Does SnapScan actively exploit vulnerabilities?: Not by default. Active verification only runs when the job explicitly allows it. It is staged: the mildest level proves a flaw without running any command, and further levels need a second opt-in. Every attempt is logged, and a kill switch stops running work at once.
Where is my data stored?: SnapScan is self-hosted. We run the platform ourselves, or you run it on your side as a container or hardened appliance. Credentials for cloud, Kubernetes and DAST scans are encrypted (AES-256-GCM).
Does SnapScan help with ISO 27001 and BSI IT-Grundschutz?: Yes, as a source of evidence. SnapScan maps findings to BSI IT-Grundschutz modules and ISO/IEC 27001:2022 Annex A controls. The mapping guides prioritization and ISMS documentation. It is not a certification statement.
How do I get access?: Get in touch. We will show you SnapScan in a demo and help you decide whether the self-service scan, the platform or our managed Pentest as a Service fits you best.

See SnapScan live

We show you a scan on a sample target and help you pick the right way to start.

Request a demo Pentest as a Service

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.