See what your site is telling the internet.
Five security scanners read your site the way an attacker would. VulnSight only calls something a problem when more than one of them finds it, so you get a short list worth acting on, not a wall of maybes.
The problem with scanners
You've got five reports. Which one do you fix first?
Run five scanners yourself and you get five separate lists that overlap, disagree and repeat each other. VulnSight lines them up side by side. Anything two or more tools found independently goes to the top, and that's where your afternoon should go.
| What was found | Headers | Nmap | Nuclei | ZAP | NVD | Priority |
|---|---|---|---|---|---|---|
| No Content-Security-Policy | Headers found this | Nmap did not find this | Nuclei did not find this | ZAP found this | NVD did not find this | Do this first2 of 5 agree |
| Page can be framed by other sites | Headers found this | Nmap did not find this | Nuclei did not find this | ZAP found this | NVD did not find this | Worth fixing2 of 5 agree |
| Server version on show: Apache 2.4.7 | Headers found this | Nmap found this | Nuclei did not find this | ZAP found this | NVD found this | Do this first4 of 5 agree |
| Browsers allowed to guess file types | Headers found this | Nmap did not find this | Nuclei did not find this | ZAP found this | NVD did not find this | Worth fixing2 of 5 agree |
| Traffic sent unencrypted | Headers found this | Nmap did not find this | Nuclei did not find this | ZAP did not find this | NVD did not find this | Verify, then fix1 of 5 agree |
Real output from the sample scan in the console above. 19 raw observations became 15 findings, 4 corroborated.
Rules run first
Matching happens on a fixed list, not a model. The same scan always produces the same result.
AI can't change a rating
Severity comes from scoring you can audit. A model may explain a finding or order the fixes; it cannot re-rate one.
No evidence, no merge
Two findings are only combined when both carry the tool output that proves them.
Under the hood
What runs, in order.
The real steps and real times from the scan above, as one bar split by where the time went. If a tool cannot run, the report says so rather than quietly leaving a hole.
- 1Look up the siteDNS, redirects, headers, cookies, how traffic travelsDNS + HTTP2s
- 2Open it in a browserReal Chromium, screenshot, the page as it actually rendersChromium6s
- 3Check which doors are openTop 3,000 ports, plus what software answers on eachNmap41s
- 4Test known weaknessesThousands of community checks, low through criticalNuclei154s
- 5Read the trafficWatching only. Nothing is crawled and nothing is attackedZAP3s
- 6Match against known flawsPublic CVE records for the versions found, then score itNVD4s
$ nuclei -u http://scanme.nmap.org/ \ -jsonl -silent -no-color \ -severity 'low,medium,high,critical' \ -timeout 8 -retries 1 \ -rate-limit 50 -concurrency 25 \ -bulk-size 25 -templates /opt/nuclei-templates # finished in 154s of a 420s budget nothing was cut short
- Software
- Apache httpd 2.4.7
- Found by
- Headers, Nmap, ZAP, NVD
- Where
- port 80
- Known flaw
- CVE-2021-44224 · 8.2
- Rating
- Medium
Safety
Checking, not attacking.
VulnSight uses the same tools a security professional would, kept to what is safe to run on a live site. Every scan needs your say-so, government and cloud-provider domains are refused outright, and there's a limit on how often you can scan.
- Reads security headers, cookie settings and the HTTPS certificate
- Checks which ports are open and what's listening, with a time limit
- Runs known-weakness checks, low through critical
- Watches traffic passively with ZAP
- Looks up public CVEs for versions it actually saw
- Guess passwords or try to log in
- Flood the site or knock it over
- Run exploits or send attack payloads
- Let ZAP switch into attack mode
- Let a model invent a finding or change its rating
Read a finished report before you scan anything.
Everything above came from one real scan. Here's the whole thing.
Open the sample report →