No. VeilScan is an automated external attack surface monitoring tool, not a penetration test. A penetration test is a time-boxed, manual assessment conducted by a human security professional. It produces a point-in-time report and typically covers both external and internal systems depending on scope.
VeilScan is continuous, automated, and external-only. It scans only what is visible from the public internet. The two are complementary — VeilScan covers the 11 months between annual pentests and surfaces regressions that a point-in-time test would miss. See VeilScan vs manual penetration testing for a full comparison.
VeilScan scans everything visible from the public internet associated with your verified domains:
.env files, backups, configuration filesVeilScan uses a proof-based model. Before a finding reaches your report at Critical or High severity, the scan pipeline must produce concrete evidence of exploitability:
See What Is Proof-Based Vulnerability Scanning? for a full explanation.
VeilScan is designed for:
See all use cases for more.
Most scans complete within 90 to 120 minutes. Domains with many subdomains or complex infrastructure may take slightly longer. You receive an email notification when results are ready. On paid plans, a Slack alert is sent immediately when a new Critical or High finding is detected.
Yes. VeilScan maps findings to applicable controls in:
Each PDF report includes a compliance table suitable for audit submission. See Compliance Mapping for details.
Yes. VeilScan performs non-destructive, read-only external reconnaissance. It never conducts denial-of-service testing, attempts to access internal systems, modifies data, or exfiltrates anything. All scanning operates within the bounds of a signed Rules of Engagement document. VeilScan is designed to be run continuously and safely against production domains. If you have specific concerns, contact hello@veilscan.net.
You receive an email notification with a summary. Your dashboard shows the full report including your Business Impact Score, all verified findings with proof evidence, attack path analysis, compliance mapping, and remediation guidance. On paid plans you can download a signed PDF. Subsequent scans produce delta reports showing new findings and findings that have been fixed since the last scan.
Nmap tells you what ports are open. VeilScan tells you what is exploitable, what it means for your business, and what to do about it. VeilScan runs the full pipeline: subdomain enumeration, service fingerprinting, vulnerability detection, proof verification, attack path analysis, Business Impact Scoring, compliance mapping, and report generation. It delivers output a CTO or board can read without security expertise.
Yes. Scan results are stored securely in AWS eu-west-2 (London). Data does not leave the United Kingdom. VeilScan never shares scan data with third parties. If you delete your account, all data is permanently removed. See the Privacy Policy for full details.
No. VeilScan is an external-only scanner. It scans only what is visible from the public internet. It cannot scan private IP ranges, VPN-protected infrastructure, or internal services. For internal scanning, a dedicated internal vulnerability scanner or a manual penetration test engagement is required.
The free plan includes one lifetime scan of one domain. It shows Medium and Low severity findings. Critical and High findings are detected but hidden until you upgrade to a paid plan. The free scan covers the full subdomain enumeration, port scanning, TLS and email checks, cloud misconfiguration signals, admin panel detection, and a preview Business Impact Score. No credit card required. See the free scan page for full details.