Loading…
Interactive demo
PentSeal demo
How PentSeal scopes an engagement, verifies ownership, and records a signed authorization before any testing is allowed to run.
This is an interactive walkthrough of the authorized-testing workflow with sample data. It runs no scan: nothing is tested until you verify ownership and sign an authorization in a workspace, and every scan then passes the Safe-Scan Gate.
Scope your engagement
Add domains you own. Every asset is ownership-verified, and the whole scope is authorized before any scan can run.
How the authorization gate works
1. Add domains you own — each one is verified by a DNS TXT or file challenge.
2. Record authorization — sign the scope and rules of engagement for the agreed window.
3. Pass the Safe-Scan Gate — checks run only inside that authorized scope and time window.
No asset is scanned until its ownership is verified and its authorization is signed.
Demo mode: verification is simulated locally — no DNS/HTTP challenge is performed.
Assets Table
Showing 0 assets (scroll to load more) — sample data: IANA example names + RFC 5737 documentation IPs
API security analysis
Not available yet — preview onlyCloud posture review
Sample — not a scan resultSample data — illustrative examples only, not produced by a scan of any real environment.
- aws · s3 · samplehigh
public access
S3 bucket allows public read access. Sensitive data may be exposed.
Illustrative resource: example-bucket — never observed anywhere
- aws · iam · samplecritical
root account usage
Root account is being used for daily operations. This violates security best practices.
Illustrative resource: root-account — never observed anywhere
- aws · ec2 · samplehigh
overly permissive security group
Security group allows inbound traffic from 0.0.0.0/0 on port 22 (SSH).
Illustrative resource: sg-12345678 — never observed anywhere
- aws · cloudtrail · samplehigh
logging disabled
CloudTrail logging is not enabled in all regions.
Illustrative resource: default-trail — never observed anywhere
- azure · storage · samplehigh
public blob access
Storage account allows anonymous public access to blob containers.
Illustrative resource: storageaccount123 — never observed anywhere
- azure · network · samplecritical
unrestricted rdp access
Network Security Group allows RDP (port 3389) from any source.
Illustrative resource: nsg-prod-001 — never observed anywhere
- azure · activedirectory · samplehigh
mfa not enforced
Multi-factor authentication is not enforced for all users.
Illustrative resource: tenant-id — never observed anywhere
- gcp · storage · samplehigh
public bucket
Cloud Storage bucket is publicly accessible.
Illustrative resource: bucket-name — never observed anywhere
- gcp · compute · samplemedium
default service account
Compute Engine instance uses default service account with excessive permissions.
Illustrative resource: instance-1 — never observed anywhere
- gcp · compute · samplehigh
overly permissive firewall
VPC firewall rule allows SSH from 0.0.0.0/0.
Illustrative resource: firewall-rule-1 — never observed anywhere
Want a guided walkthrough?
This demo is a self-serve walkthrough with sample data. For a live walkthrough of your own workflow, book time with the PentSeal team.
Book a demo