Automated assessment is not a penetration test — and we say so

• Continuous, repeatable coverage of the external configuration and exposure of your web assets.
• A documented, transparent security score and a findings lifecycle your team can work through.
• Evidence and remediation guidance for every finding, plus Verify Fix to confirm a fix.
• Monitoring that catches regressions between assessments: TLS, DNS, headers and uptime.
• Authorization records with user, IP, timestamp and scope for every active scan — useful when you need to show that testing was sanctioned.

What TasScan does not deliver

• Manual, creative testing of business logic, authorization flaws between users, or chained attacks.
• Exploitation of any kind. Our checks are observational or use safe, read-only proof techniques.
• Testing behind logins or of internal networks. Authenticated scanning (testing behind a login) is not available today. Internal networks are out of scope.
• Compliance certification. Reports can support your programme but are not an audit opinion.

How to read automated results

• Automated scanning is not a penetration test.
• A reflected marker shows that input is echoed back; it is not verification of cross-site scripting.
• A version match shows that software is reported at a version affected by an advisory; it is not proof that the issue is exploitable on your system.
• A fingerprint is the software we observed in headers and markup, not an audit of it.

Using TasScan alongside a penetration test

• Run TasScan before an engagement so testers spend their time on what automation cannot find.
• Share the technical report and authorization records with your testers as scope context.
• After the engagement, track the tester's findings alongside TasScan's in your own tracker and use monitoring to make sure fixed configuration stays fixed.

Authorized testing only

Every active scan requires proof of ownership of the target and an explicit Authorized Security Testing confirmation, stored with your identity, IP address, browser and timestamp. Scanning targets you do not own or are not authorized to test is a breach of the Acceptable Use Policy and may be unlawful.