Asset inventory
Track assets, groups, business owner, technical owner, environment, criticality, exposure, tags and assessment status.
AVAILABLE PILOT / AUTHORIZED TESTING ONLY
Find vulnerabilities. Validate risk. Drive remediation.
Devnora VM + VAPT brings asset inventory, finding lifecycle, authorization-gated engagements, remediation ownership, retest evidence and commercial reports into one tenant-bound workflow.
VM DASHBOARDCritical 1 / High 3
Asset -> finding -> owner -> SLA -> retest -> report
Concept visual, not production telemetryVulnerability lifecycle
Manage CVE, CWE, CVSS, severity, evidence, impact, remediation, assignment, SLA, due date, false positive, duplicate and risk acceptance states.
Authorized VAPT engagements
Define scope, exclusions, target assets, schedule, testing window, rules of engagement, emergency contact, permitted methods and prohibited actions.
Findings validation
Support analyst validation, reviewer approval, customer visibility and audit history without claiming certification.
Remediation and SLA
Assign owners, track due dates, identify overdue issues and keep remediation evidence attached to the finding.
Retesting
Request retest, record PASS/FAIL/PARTIAL/NOT_TESTED outcomes and reopen or resolve findings with evidence hashes.
Authorization gate
No active testing without explicit current approval.
The platform requires tenant match, authorized target, current authorization, permitted testing window, allowed method, source-IP allowlist where configured and approval evidence. Unauthorized active scanning remains prohibited.
- ScopeCustomer-approved assets and exclusions
- AuthorizeOwner approval, rules and evidence hash
- IngestManual, CSV, JSON, Nmap XML and runner-result metadata
- RemediateOwner, SLA and retest proof
- ReportExecutive and technical report views
Asset inventory
| Asset | Owner | Exposure | Status |
|---|---|---|---|
| payments-api | Platform | Internet | Validated |
Finding drawer
Broken Access Control
Severity CRITICAL, CWE-284, SLA 7 days, retest required.
Engagement timeline
Scope review -> authorization -> scheduled window -> evidence review -> final report.
Runner architecture
Optional runner uses tenant-bound identity, target allowlist, restricted job allowlist, timeout, rate limit and result hashing. It is not active by default.
Reports
Executive VAPT Report, Technical VAPT Report, Vulnerability Summary, Asset Risk Report, Remediation Status, SLA Compliance, Retest, Risk Acceptance, Finding Register and Engagement Closure formats are release-gated.
Customer portal
Customers can review authorized scope, visible findings, remediation queue and final reports through server-side tenant and role checks.
Supported imports
Generic CSV, generic JSON and Nmap XML preview are implemented. Nuclei, ZAP, OpenVAS and Nessus-compatible import adapters remain planned until parser-level proof is added.
Runner integrations
External runner execution requires explicit tenant authorization, approved targets and separate deployment proof. Autonomous production scanning is not claimed.
FAQ
Honest availability answers.
Does Devnora perform active scanning now?
No production active scanning is enabled from this website. The platform models authorization and result ingestion; runner execution needs separate explicit approval for owned targets.
Does this replace penetration testers?
No. It organizes authorized VAPT workflow, evidence, remediation and reports. It does not claim certified penetration testing or automatic exploitation.
Are reports certification?
No. Reports describe scope, methodology, limitations, findings, evidence, remediation and retest status. They do not certify compliance.
Bring VM + VAPT into a controlled pilot.
Use a small authorized scope, import existing evidence and verify remediation workflow before adding any runner integration.