VAaaS

VAaaS is two things. The assessment service is delivered today by our team, as we have always delivered it. The platform under it is in development: the whole delivery loop is built (profile, methodology, testing, findings, reports and retests), but it has not been deployed or released yet, and no organization runs it today. We are looking for design partners to take it on first.

A scanner checks an application against patterns it already knows and has no idea what your application is for. Here the work starts from a profile of the application — its roles, workflows and business rules — and the scenario set is built for it. Scanners still run, as one input among several, but what they report is correlated and validated rather than forwarded to you as a finding list.

It is the record of what your application is: which roles exist, which workflows matter, where it takes input, what it is built on, which business rules must hold, and the history of what has been found and fixed. It belongs to the application rather than to an engagement, so it is still there next year, and it is what lets the next assessment test the difference rather than start over.

No, and that is the point. The second engagement covers what changed, what was previously excluded or out of time, and whether earlier findings are genuinely fixed. You agree that scope in advance; the platform shows what it means in terms of test cases so the decision is informed.

Because it is not a claim in a paragraph. Every test case in the engagement has a state: executed with its evidence, or excluded with a reason. You can read that list, and so can an auditor. When the reason is "no time" or "blocked by the environment", it says so.

Not yet. The platform is designed to install on your own infrastructure, the usual choice when scope data, evidence or findings cannot leave the organization, but it has not been deployed anywhere so far. Today we deliver the engagements; once the platform is deployed you will be able to run it yourself, or mix the two: your team on routine work, ours on the deep engagements, one history per application.

Each test case says whether it is expert-only, agent-assisted or agent-eligible. Today every case is executed by our experts. Running eligible cases with agents, through Hafez Fabric, inside sandboxes, under approval rules and an audit trail, is planned as the AI-Driven Pentest add-on, which is in design. Judgement (what a finding means for your business) stays with the expert, and nothing will be published as a finding because a model said so.

No. Your scope, evidence and findings are yours. AI features are designed to run through Hafez Fabric, which can mask sensitive values before any request reaches an external model, and an installation on your own infrastructure can be restricted to models running inside your network.

Registering an asset never authorizes testing it. Scope is an explicit, versioned agreement, and assets outside it are not available to the engagement. Discovery can suggest an asset; a person still has to accept it and authorize any testing.

A report in Persian or English with findings rated by CVSS, each carrying the evidence and the steps to reproduce it, remediation guidance written for the team that will apply it, and the coverage record. Once the platform is deployed, you also keep the profile, the test-case history and the retest results inside it.

A retest is verification of a specific finding, not a new assessment. The original evidence and steps are there, the fix is checked against them, and the result is recorded. A closed ticket is not treated as proof, and a mitigation is not recorded as a resolved defect.

Yes. Imported results become occurrences and are correlated into managed issues alongside ours, without overwriting the source record. One weakness reported by three tools is one thing to fix, and a finding that simply disappears from a later import is not treated as fixed.

Asset identity is scoped to the organization, so two customers registering the same hostname never meet. Engagements are visible to the people assigned to them, and every action against a finding or a scope is recorded with who did it.