Frequently Asked Questions

ASVP uses agentless deployment and integrates with your existing SIEM, EDR, firewall, and cloud environments in under 30 minutes. There is no software to install, no agents to deploy, and no complex infrastructure changes required. Most clients run their first security simulation within the first hour of connecting the platform. Our implementation team provides guided onboarding and is available throughout the process.

No. ASVP is designed to be completely safe for production environments. All attack simulations are conducted using controlled, non-destructive techniques that mimic real attacker behavior without causing actual damage, data loss, or service disruption. ASVP has been running in live enterprise environments — including banks, hospitals, and government agencies — without a single production incident. You can also configure simulation windows, exclusion lists, and intensity levels to match your operational requirements.

ASVP integrates natively with 50+ security tools across all major categories: SIEM (Splunk, Microsoft Sentinel, IBM QRadar), EDR (CrowdStrike, SentinelOne, Microsoft Defender), firewalls (Palo Alto, Fortinet, Check Point), cloud security (AWS Security Hub, Azure Defender, Google Chronicle), and ticketing (ServiceNow, Jira). ASVP measures whether your actual deployed tools detect and block the simulations — making these integrations the core of how it delivers value. Custom integrations are available via REST API for enterprise deployments.

MITRE ATT&CK is a globally recognized knowledge base of real-world adversary tactics and techniques, maintained by the non-profit MITRE Corporation. It documents exactly how attackers operate — from initial access through execution, persistence, privilege escalation, lateral movement, and data exfiltration. ASVP maps all 5,000+ of its attack scenarios directly to MITRE ATT&CK techniques and threat actor profiles, so every simulation represents how a real adversary would attack your specific environment. This means your security score reflects your actual defensive coverage against real threats — not theoretical vulnerabilities.

Yes. We offer a structured 14-day proof of concept for enterprise clients, fully guided by our security engineering team. The POC is conducted in your live environment against your actual security controls. At the end of the POC period, you receive a complete security validation report showing exactly what ASVP found — the gaps, the control effectiveness scores, and prioritized remediation recommendations. This gives you concrete evidence of value before any purchase decision.

The ASVP security score is a dynamic, weighted metric that reflects the percentage of simulated attacks that your security controls successfully blocked or detected. It factors in attack severity, technique coverage across the MITRE ATT&CK matrix, the criticality of affected assets, and whether your tools generated the appropriate alerts. The score is updated continuously after every simulation run — unlike CVSS scores, which are static theoretical ratings. A higher score means your defenses actually stop attacks; a lower score tells you exactly where the gaps are and what to prioritize.

In many cases, yes — and often it provides stronger evidence of compliance than a traditional pentest. ASVP generates machine-readable, continuous evidence of security control effectiveness that is accepted by auditors for ISO 27001, SOC 2, PCI-DSS, NCA ECC, SAMA, and NIST frameworks. However, some regulatory requirements still mandate a human-conducted penetration test at specific intervals. Our compliance team can advise on exactly what ASVP covers for your specific regulatory obligations and where supplementary testing may still be required.

ASVP is a modular platform with 8 core capability areas: Continuous Security Validation, Attack Surface Monitoring, API Security Testing, DevSecOps Pipeline Security, WAF Detection & Validation, Compliance Readiness, Repository Risk Scoring, and Threat Exposure Analysis. Each module can be licensed individually or as part of the full suite. Enterprise licenses include all modules. You can explore detailed information about each module on the ASVP Features page.

Because ASVP controls both the attack simulation and the measurement of detection, false positives are extremely rare — typically less than 0.1% of findings. Unlike vulnerability scanners that guess at risk, ASVP executes actual techniques and measures actual control responses. If a control blocks or detects the simulation, that's a true positive result. If it doesn't, that's a true gap. Our AI also reviews findings before surfacing them to reduce noise further. Customers can also mark specific findings for review or suppression through the dashboard.

Yes. ASVP provides full coverage across AWS, Azure, and Google Cloud Platform — including cloud-specific attack scenarios like S3 bucket misconfiguration exploitation, IAM privilege escalation, container escape, serverless function abuse, and cloud metadata service attacks. ASVP integrates with AWS Security Hub, Azure Defender for Cloud, and Google Chronicle to measure cloud security control effectiveness. Attack Surface Monitoring also continuously scans your cloud footprint for unknown and misconfigured assets.

ASVP generates multiple report types tailored to different audiences: Executive Security Posture Reports (board-ready, business-risk language), Technical Remediation Reports (specific fix guidance for security engineers), Compliance Evidence Reports (control coverage mapped to specific frameworks like ISO 27001, NCA ECC, PCI-DSS), MITRE ATT&CK Coverage Maps (heatmap of your detection coverage across all 14 tactics), and Trend Reports (posture improvement or degradation over time). All reports are available on-demand at any time from the dashboard, or scheduled for automatic delivery.