Validation
Confirm exploits without setting off alarms
Before you file a remediation ticket, Validation confirms whether a detected vulnerability is actually exploitable in your environment. Safe emulation probes test the exposure path without executing payloads that could destabilize production systems or trigger security tooling.
Key capabilities
- Safe emulation probes confirm exploitability without executing destructive payloads
- Subdomain-takeover checks verify dangling CNAME targets against a live registry of claimable services
- Credential-stuffing simulation tests whether a leaked credential pair can authenticate to your services
- Validation results attach to the finding record and factor into the composite risk score
- All probes are scoped to your authorized assets — no lateral movement outside your perimeter
- Probe transcripts are stored for audit and can be exported for compliance evidence
How it works
Validation probes are purpose-built test cases, not generic exploit frameworks. Each probe targets a specific vulnerability class — for example, a takeover probe fetches the CNAME chain, identifies the ultimate target, queries the registrar's domain-availability API, and reports whether the domain is claimable. No content is injected and no domains are actually registered.
Credential-stuffing simulation is limited to your authorized services. You provide a list of credential pairs (from a breach dataset you own) and the service endpoint. The probe attempts authentication once per pair with a throttle that stays well below rate-limit thresholds. A successful authentication is logged as a confirmed finding with the pair redacted in the evidence record.
Probe execution is gated by your plan tier. Pro plans can run validation against any finding manually. Enterprise plans can configure automatic validation triggers — for example, automatically validate any newly opened finding on a KEV-listed CVE. Probe results feed back into the scoring model: a confirmed-exploitable finding receives a score boost that pushes it above unvalidated findings of similar base severity.
Ready? Try Validation.
No credit card required. Start free, upgrade when you need more.