Is this legal? Do I need permission?

AttackVector performs passive security scanning only — we analyze publicly available information like HTTP headers, SSL certificates, and technology fingerprints. We do NOT perform active exploitation. However, you should only scan websites you own or have explicit authorization to test.

How does AttackVector compare to traditional pentesting?

Traditional penetration tests cost $5,000–$50,000+ and take weeks. AttackVector provides instant AI-powered scanning starting at $79/mo. While it doesn't replace a full manual pentest for compliance purposes, it catches 80% of common vulnerabilities at 1% of the cost.

What does the free tier include?

The free scan includes SSL/TLS certificate analysis, HTTP security headers audit, technology stack detection, your top 3 vulnerabilities, and an overall security grade (A-F). Upgrade to Pro to unlock all vulnerabilities, CVE matching, and AI remediation guides.

How do the AI agents work?

AttackVector uses a pipeline of specialized AI agents: Recon Agent discovers endpoints, Fingerprint Agent detects your tech stack, Scanner Agent checks for misconfigurations, CVE Matcher cross-references the NVD database, and Report Writer generates human-readable findings with fix instructions.

How often should I scan my site?

We recommend scanning after every deployment and at least weekly. Pro subscribers get continuous monitoring with weekly automatic re-scans. New CVEs are published daily, so regular scanning is essential.

Can AttackVector scan internal/private networks?

No. For security reasons, AttackVector only scans publicly accessible URLs. We block requests to private IP ranges (localhost, 10.x.x.x, 192.168.x.x, etc.).

What is automated penetration testing?

Automated penetration testing uses AI and software tools to simulate cyberattacks on your systems, identifying vulnerabilities without requiring a human security consultant. AttackVector automates recon, fingerprinting, vulnerability scanning, CVE matching, and report generation — delivering results in seconds instead of weeks.

How much does a penetration test cost?

Traditional manual penetration tests cost between $5,000 and $50,000+ per engagement. AttackVector provides AI-powered pentesting starting with a free tier, with Pro plans at $79/mo and Premium at $199/mo — making enterprise-grade security accessible to startups and small businesses.

What vulnerabilities does AttackVector detect?

AttackVector detects OWASP Top 10 vulnerabilities including SQL injection, cross-site scripting (XSS), CSRF, broken authentication, security misconfigurations, sensitive data exposure, and more. Pro and Premium plans add CVE matching against the National Vulnerability Database, DNS security auditing, API security testing, and frontend pentesting.

Is AI pentesting as good as manual penetration testing?

AI pentesting catches 80% of common vulnerabilities instantly and is ideal for continuous monitoring. Manual pentesting is still recommended for compliance audits (PCI DSS, SOC 2) and testing complex business logic. AttackVector is best used as a complement — providing continuous coverage between annual manual pentests.

What is a CVE and how does CVE scanning work?

CVE (Common Vulnerabilities and Exposures) is a standardized system for identifying known security vulnerabilities. AttackVector detects your technology stack (frameworks, libraries, servers) and cross-references them against the National Vulnerability Database (NVD) with 50,000+ CVE entries to find known exploits affecting your software versions.

How do I check if my website is secure?

Enter your website URL at attackvector.tech/scan to get a free instant security assessment. You'll receive a security grade (A-F), SSL/TLS analysis, HTTP security headers audit, technology detection, and your top vulnerabilities — all in seconds with no signup required.

What is OWASP Top 10 and why does it matter?

The OWASP Top 10 is the industry standard list of the most critical web application security risks, published by the Open Worldwide Application Security Project. It includes injection attacks, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfigurations, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging. AttackVector scans for all 10 categories.

Does AttackVector test APIs for vulnerabilities?

Yes. Pro and Premium plans include API discovery and API security testing. AttackVector automatically discovers API endpoints, then tests for SQL injection, command injection, authentication bypass, IDOR, rate limiting issues, CORS misconfigurations, and mass assignment vulnerabilities in your APIs.

What is a DNS security audit?

A DNS security audit examines your domain's DNS configuration for security issues including missing SPF, DKIM, and DMARC records (email spoofing protection), DNSSEC validation, zone transfer vulnerabilities, dangling DNS records, and subdomain takeover risks. AttackVector includes comprehensive DNS auditing in Pro and Premium plans.

How does AI-powered vulnerability scanning work?

AttackVector deploys multiple specialized AI agents in parallel: a Recon Agent maps your attack surface, a Fingerprint Agent identifies your technology stack, a Scanner Agent tests for misconfigurations and vulnerabilities, a CVE Matcher finds known exploits in your software, and a Report Agent generates human-readable findings with step-by-step remediation guides.

Privacy Policy | AttackVector

1. Information We Collect

Account Information

When you sign in via Google OAuth, we collect:

Email address
Display name
Profile avatar
Authentication tokens for secure access

Scan Data

When you use our scanning services, we collect:

URLs and domains you submit for scanning
Scan results, vulnerability findings, and generated reports
Scan configuration preferences and history

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, CVVs, or full card details on our servers. We receive confirmation of payment status and subscription details from Stripe.

Usage Data

We automatically collect:

IP address and browser type
Device information and operating system
Pages viewed and features used
Log data (access times, errors, referral URLs)

2. How We Use Information

We use the information we collect to:

Provide, operate, and maintain the AttackVector platform
Process payments and manage subscriptions
Generate vulnerability reports and security assessments
Improve our scanning accuracy and AI models
Monitor for abuse, fraud, and unauthorized usage
Send important service notifications and updates
Comply with legal obligations

3. Third-Party Services

We integrate with the following third-party services:

Google OAuth: Authentication and single sign-on
Stripe: Payment processing and subscription management
OpenAI: AI-powered vulnerability analysis, report generation, and remediation guidance
NVD API (NIST): CVE data retrieval and vulnerability cross-referencing

These services have their own privacy policies and may collect data as described in their respective policies.

4. Data Sharing

We do not sell your personal data. We may share data in the following circumstances:

With service providers listed above, solely to operate the platform
When required by law, subpoena, or legal process
To protect our rights, safety, and prevent fraud
With your explicit consent

Scan target URLs may be sent to third-party APIs (OpenAI, NVD) for analysis. We do not share your scan results with other users or third parties.

5. Data Security

We implement industry-standard security measures including:

JWT-based authentication with encrypted tokens
HTTPS/TLS encryption for all data in transit
Secure storage with access controls and logging
Regular security reviews of our infrastructure

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Your Rights (GDPR)

If you are in the EU/EEA, you have the following rights under the General Data Protection Regulation:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your personal data
Portability: Receive your data in a structured, machine-readable format
Objection: Object to certain types of data processing
Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at privacy@attackvector.tech

7. Data Retention

Scan results: Cached for 24 hours for performance. Saved reports are retained while your account is active.
Account data: Retained for the duration of your active account.
Payment records: Retained as required by applicable tax and financial regulations.

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

8. Cookies & Local Storage

AttackVector uses:

Session cookies: To maintain your authenticated session
localStorage: To store authentication tokens and user preferences client-side

We do not use tracking cookies or third-party advertising cookies.

9. Children's Privacy

AttackVector is intended for users aged 18 and older. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy questions or to exercise your data rights, contact us at:

Email: privacy@attackvector.tech

Website: https://attackvector.tech