Panptes
[Products]

One asset pool. Five products over it.

Register an asset and prove you own it once. Every product is a lens over that one verified pool — the autonomous pentest and four continuous scanners — all feeding a single findings feed.

Verified ownership

Nothing is scanned or tested until you've proven you own it. Ownership is bound to the exact asset and surface — register once, reuse everywhere.

The Proof Loop

No finding without evidence. Every result links a stored, masked proof artifact — reproduction steps, not a backlog of maybes.

01/Human-gated

Autonomous Pentest

Agent-driven exploitation, proven through the Proof Loop

Engines

Panoptes agentrecon → exploit chainZAP (active)

The Attack product. AI agents reason like a red team across your in-scope verified assets — chaining access-control, tenant-isolation and business-logic flaws — and prove what's actually exploitable. Live exploitation is human-gated; you get reproduction steps and stored evidence, priced by scope and never per asset.

What it covers

  • Access control & tenant isolation
  • Business-logic abuse & workflow chains
  • Multi-step exploit paths across surfaces
  • Verified-pentest scope bands + estimator
02/Continuous · read-only

Code Scanning

Repos: SCA, Secrets, SAST, IaC, SBOM & malware

Engines

TrivyOSV-ScannerGitleaksSemgrepCheckovSyftGuardDog

Connect a repository and Panoptes watches every push. Vulnerable dependencies, leaked secrets, insecure code, infrastructure-as-code misconfig, a full SBOM and malicious packages — one read-only pass, prioritised by reachability and CISA KEV.

What it covers

  • SCA — dependency CVEs, reachability-ranked
  • Secrets — leaked keys & tokens (masked)
  • SAST — insecure code, OWASP/CWE mapped
  • IaC misconfig · SBOM · malicious packages
03/Continuous · read-only

Container Scanning

Image CVEs, EOL base images, SBOM & malware

Engines

Trivy imageGrypeSyft

Scan image layers for known CVEs across OS and application packages, flag end-of-life base images, generate an SBOM and catch malicious packages — re-scored by how the image is actually deployed.

What it covers

  • Layer-by-layer OS + app CVEs
  • End-of-life base image detection
  • CycloneDX / SPDX SBOM export
  • Malicious package detection
04/Continuous · agentless

Cloud & VM

CSPM + VM posture across AWS, Azure & GCP

Engines

ProwlerScoutSuiteTrivy vm

Agentless, read-only review of your cloud configuration — exposed services, over-broad IAM, risky defaults — plus snapshot-based VM scanning. Every check maps to a compliance control and is re-scored by real exposure.

What it covers

  • CSPM misconfig & over-permissioned IAM
  • Public exposure & risky defaults
  • Snapshot VM package CVEs
  • Each check mapped to a control
05/Passive = watch · active = gated

Surface & DAST

Discover what you expose, then test it

Engines

subfinderhttpxtlsxnucleikatanaZAP

Discover the domains, hosts and services you actually expose — including the ones nobody remembers deploying — watch them for change, and run passive web/API checks on the continuous cadence. Active DAST and the deep agentic scan stay behind a per-run authorization.

What it covers

  • Subdomain & host discovery, change alerts
  • Passive headers, TLS, exposed-lib CVEs
  • Active REST/GraphQL fuzzing (gated)
  • Deep agentic scan (the pentest)
Start scanning free See pricing