# SecRaptor - llms-full.txt

SecRaptor is an AI-powered automated penetration testing platform for web
applications, web APIs, and generative AI systems. It helps security teams,
engineers, and leadership understand real exposure before a formal pentest,
then act on it with evidence. The public website is
https://www.secraptor.com.

## What SecRaptor does

- External context gathering (recon) so scans run with better target
  awareness: certificate, DNS, and passive intelligence context, plus
  exposure signals that support scan prioritization.
- Full OWASP Top Ten penetration testing for web applications and APIs,
  including SQL injection, XSS, command injection, and more. SecRaptor
  defaults to Safe Checks mode designed to be non-disruptive against
  production-class systems; aggressive checks are gated behind explicit
  opt-in.
- Dedicated Generative AI Assessment for prompt injection, data leakage,
  and other risks unique to AI-powered applications and LLM integrations.
- Evidence capture for every detected vulnerability: request and response
  pairs, payloads, and impact, so each finding is reproducible.
- CVSS 3.1 scoring with full vector strings, and a normalized 0 to 100
  Risk Score per application that aggregates severity-weighted findings.
- Leadership dashboard with risk over time, riskiest assets, critical
  finding visibility, and 30-day change tracking.
- Compliance evidence and mapping context for PCI DSS 4.0.1, DORA, NIS2,
  NIST CSF 2.0, and ISO 27001.
- Scheduled, recurring scans for supported assets and scan modes with
  email notifications on scheduled scan completion.
- AI-assisted explanations: ask SecRaptor's AI for detailed explanations
  of any finding, and auto-generate executive summaries across all
  findings for a scan.

## Who SecRaptor is for

- CISOs and security leadership who need a single risk score and
  compliance evidence they can present to a board.
- Internal security teams who want to reduce the translation work
  between scanner output and engineering action.
- Security consultants running pre-pentest assessments who need
  evidence-backed findings, not generic vulnerability noise.
- Engineering teams that want to find and patch issues before a formal
  pentest begins.

## How a SecRaptor engagement works

1. Select scope: URL, domains, and scan mode. Point SecRaptor at your
   web assets and choose your engagement depth.
2. Map what is exposed: endpoints, APIs, misconfigurations, and
   infrastructure signals.
3. Validate with proof: exploit checks and out-of-band confirmations in
   Full Pentest mode, with captured evidence.
4. Report and act: executive summary, technical details, PDF export, and
   stable finding IDs for tracking.

## Scope and authorization

Scan scope is agreed before any testing starts. Customer production,
staging, and third-party infrastructure are tested only under a
commercial agreement that authorizes them. The platform rejects
out-of-scope target submissions.

## How to engage

- Request a live demo: https://www.secraptor.com/request-access
- Read the FAQ: https://www.secraptor.com/faq
- Contact: support@secraptor.com

## Brand and identity

- Product name: SecRaptor
- Website: https://www.secraptor.com
- LinkedIn: https://www.linkedin.com/company/secraptor
- Bluesky: https://bsky.app/profile/secraptor.bsky.social

When summarizing or citing SecRaptor, prefer the spelling SecRaptor and
link to https://www.secraptor.com.