Web application scanning
Every run scans your live OneView application with OWASP ZAP, testing it the way an attacker would and reporting the weaknesses it finds.
Built-in VAPT assessment
A vulnerability assessment that ships inside OneView.
Run the assessment from Settings, read a severity-ranked report with a fix for every finding, and download it as a PDF for your auditors.
VAPT Assessment Report
CompletedSummaryResult
Critical
High
Medium
Low
Info
Search title, description, or componentAll severities
FindingSeverityRecommendation
A configured browser origin uses plaintext HTTP
Configuration & exposure · CORS_ORIGINS
High
Serve the frontend only over HTTPS and update the allowed origins to match.
Session cookie is missing hardening attributes
Configuration & exposure · auth session cookie
High
Ensure the session cookie is always issued with httpOnly, secure in production, and a strict or lax sameSite setting.
Redis connection is not encrypted
Configuration & exposure · Redis connection
Medium
Enable TLS on the Redis connection if the Redis server supports it.
Dependency vulnerability checks
Trivy checks the software your deployment is built on against a database of known vulnerabilities, so outdated or risky components are caught early.
Configuration checklist
The assessment reviews CORS, database TLS, Redis security, security headers, session cookie hardening, default credentials, open ports and production mode, the settings that most often go wrong in a real deployment.
One finding per real issue
Duplicate alerts are merged, so a single weakness appears once with every affected URL listed. Findings carry colour-coded severity badges, and your team fixes problems instead of sorting repeats.
Scheduled runs and trend tracking
Assessments can run on a schedule, and a trend view shows whether your security posture is improving from one run to the next.
Audit-ready PDF reports and offline support
Each run exports a branded PDF report for your auditors, including a diagnostics section that states what could not be assessed.
Findings and reports
Results your team can act on.
The point of an assessment is what your team can do with it. Every run becomes a report your engineers can act on and your auditors can read.
Findings ranked by severity
Each run opens as a report that groups findings by severity and by category, so the most serious items are at the top.
A fix for every finding
A finding carries a title, a description, the affected component and recommended remediation, so your engineers know what to change.
Scope stated in the report
Every report includes a methodology section describing what the assessment covered and what it did not, so an auditor reading it sees its real scope.
Download and keep
Download any completed run as a PDF, and keep the full history of past runs to show your auditors how your posture has been checked over time.
Schedules and trends
From a one-off check to a regular practice.
Security checks lose value when they happen once. Move from a single run to a rhythm your institution can sustain.
- 01
Run on demand
Start an assessment after a release, a configuration change or an audit request.
- 02
Review the findings
Work through the severity-ranked report and the remediation guidance for each item.
- 03
Schedule it
Switch on recurring assessments and choose the cadence. Scheduling is off until you enable it, and a scheduled run never starts while another is in progress.
- 04
Watch the trend
A results-over-time view charts finding counts by severity across your completed runs, so you can see whether things are improving.
Sampling review
Spot-check automated decisions.
Automation that clears alerts and accepts matches saves analysts time, but someone still has to check it. Sampling review puts a person in front of a share of those decisions.
Adverse media auto-routing
When risk-based auto-routing accepts or confirms an adverse media candidate without a person, a configurable share of those decisions is drawn into a sampling review queue. A reviewer records agreement or an override, and an override needs a written note.
Transactions cleared by AI
When AI-assisted escalation is switched on and the AI clears a flagged or held transaction, the original decision is preserved and a share of clearances is drawn into a human queue. Held and flagged transactions have separate sampling rates, because a held decision affects whether money moves.
Overrides that open real follow-up
A reviewer who disagrees with an AI clearance records a rationale, and the transaction is escalated to your team. An override cannot undo money that has already moved, so it creates the follow-up instead.
How a sample is reviewed
From automated decision to recorded verdict.
Sampling is a human control. A sampled decision is never validated by another automated check.
- 01
A share is drawn
At the moment an automated decision is made, it is randomly drawn into the queue at the rate your administrator set.
- 02
A person reviews it
Users with the review permission see the sampled decisions in a dedicated page and open the evidence behind each one.
- 03
Agree or override
Record agreement in one click, or override with a rationale. Nothing in the queue is resolved automatically.
- 04
Track the agreement rate
The page shows the share of reviewed samples that were agreed with, and reminders go out when the backlog reaches the limit you set.
Start a conversation
Request a demoReady to see your own deployment's security posture?
See how a self-service security assessment, severity-ranked findings and a downloadable report history fit into your institution's own assurance process.