Security testing you can verify.
Not just a PDF you have to trust.
Smoke Test tests web applications from the outside every day and every week, then issues signed reports. If one was shared with you, you can confirm it is genuine and see exactly what it covers.
Findings mapped to recognized standards
Received a Smoke Test Report?
Here is how to confirm it is genuine and understand what it tells you.
Check It Is Authentic
Every report version is signed with Smoke Test's Ed25519 key. The verification page confirms the signature and lists the SHA-256 fingerprint of each sealed file, so you can confirm your copy has not been altered.
See What Was Tested
Testing only starts after the site owner proves control of the domain by email or DNS. The report states the verified target, the assessment date, and the methods used.
Know Who Reviewed It
Automated reports say so plainly. Reports reviewed by a Smoke Test analyst carry a named attestation, and the verification page shows which kind you have.
Verification never reveals the report's findings. To check a signature yourself, our public signing key is published at /report-verification-key.
How Smoke Test Tests
Daily and Weekly Testing
A baseline check runs every day and a full active assessment runs every week. A Smoke Test report reflects how the application looked days ago, not last year.
Active Application Scanning
OWASP ZAP crawls the application and actively probes for injection, cross-site scripting, misconfiguration, and the rest of the OWASP Top 10, alongside DNS, HTTP header, and exposed-port checks.
Signed-In Testing
With a dedicated test account from the site owner, Smoke Test signs in and tests the application behind the login page, where account data and administrative functions live.
Access-Control Probes
Purpose-built checks target broken access control, the top OWASP risk: requests replayed without a session, path and method tricks that slip past login checks, and record IDs swapped to reach another user's data.
AI-Assisted Analysis
An AI model classifies every discovered endpoint to aim the access-control probes, reviews all findings together to spot attack chains where smaller issues combine, and, when enabled, plans business-logic tests from a description of the application.
Independently Verifiable Reports
Each report version is frozen, fingerprinted, and signed. Anyone holding a copy can check it against our published key, without having to trust us or whoever sent it.
Fixes Are Re-Tested Automatically
A traditional pen test is a snapshot. Proving a fix usually means booking, and paying for, a retest weeks or months later.
Smoke Test re-tests every week at no extra cost. When an issue stops appearing, it is marked resolved with the date, building a record of how quickly problems get fixed.
For anyone relying on a report, that record matters more than a single clean result. It shows security is being maintained, not checked once.
See the Deliverable
The public sample is generated by the same reporting pipeline customers receive, so you can see exactly what a Smoke Test report contains.
Evidence
Affected endpoints, observed request and response evidence, confidence, and severity for each finding.
Standards Mapping
OWASP Top 10, CWE, NIST 800-53 controls, MITRE ATT&CK techniques, CVSS v4.0 base scores, and CISA KEV status.
Remediation
Prioritized fixes and mitigation notes a development team can act on.
Testing Your Own Application
Register Your Target
Enter your application URL, confirm you are authorized to have it tested, and choose email or DNS verification.
Verify Domain Control
Click the email link or publish a unique DNS TXT value. No testing happens until this step is complete.
Choose a Plan
Continuous testing at $150/month, or add an annual analyst review for $2,500/year. Testing starts automatically.
Fix, Track, and Share
Triage findings on your dashboard, watch fixes get confirmed, and share signed reports with clients through expiring links.
Simple Pricing
Start with continuous automated testing, or add an annual analyst review and signed attestation for customer and auditor handoff.
Three-month initial commitment, then month-to-month
- Weekly full active assessment
- Daily baseline scans
- Signed-in testing with your test account
- Access-control probes (authentication bypass, IDOR)
- AI-assisted endpoint classification and attack-chain analysis
- Optional AI-planned business-logic testing
- Signed, versioned reports anyone can verify
- OWASP Top 10, CWE, NIST 800-53, and MITRE ATT&CK mapping
- CVSS v4.0 base scores for reviewed finding types
- CISA KEV check of every CVE the scanner reports
- Findings dashboard with automatic fix confirmation
- Expiring, revocable client share links
Per site, billed annually
- Everything in Continuous
- One analyst-reviewed full assessment each year
- Finding classification and evidence review
- Signed analyst attestation
- Authorization and scope record
- SOC 2, ISO 27001, and PCI DSS evidence crosswalk
- Customer-ready secure report sharing
- Continuous automated retesting between reviews
FAQ
A vendor sent us a Smoke Test report. How do we know it is real?
Use the report ID or verification link printed in the report. The verification page confirms that Smoke Test issued that exact version, checks its Ed25519 publisher signature, and lets you compare the SHA-256 fingerprint of the file you received. You can also verify the signature yourself against our published key.
How are findings scored, and what does the CISA KEV section mean?
Each finding type we have reviewed carries a CVSS v4.0 base score (CVSS-B), assigned from how the issue was reached and what the evidence shows. Scores are not adjusted for your environment, and types without a reviewed vector are marked "Not scored" rather than guessed. Separately, every CVE identifier the scanner reports is checked by exact ID against CISA's Known Exploited Vulnerabilities catalog, and the report records which catalog version was used. Software without a reported CVE is not matched by product name, and if the check could not run, the report says so instead of showing "no matches".
Does a clean report mean the application is secure?
No test can prove that. A Smoke Test report is evidence of what was tested, when, how, and what was found. When weighing one, look at the assessment date, the target in scope, whether testing was signed in, and whether an analyst reviewed it. The methodology and limitations are stated in every report.
Was the vendor authorized to have this tested?
Smoke Test only tests a target after the account holder confirms authority and proves control of the domain by email link or DNS record. The time of that authorization is recorded, and Human Reviewed reports include an authorization and scope record.
Is this a real penetration test?
Smoke Test performs authorized, active security testing using OWASP ZAP, network service checks, and custom signed-in, access-control, and business-logic modules, with AI-assisted analysis. Continuous-plan reports are automated and say so explicitly. Human Reviewed reports add analyst review and a signed attestation. Neither format guarantees security or replaces an auditor's independent judgment.
How does this compare to a manual pen test?
A manual engagement can explore more deeply, but it is expensive and reflects a single point in time. Smoke Test provides repeatable weekly testing and automatic fix confirmation. The Human Reviewed plan adds analyst oversight to one selected full assessment per subscription year, with continuous testing running in between.
How is this different from running OWASP ZAP ourselves?
ZAP is one part of the process. Smoke Test adds verified scope, signed-in testing, access-control probes ZAP does not perform, AI-assisted analysis that connects related findings, weekly re-testing with fix tracking, standards mapping, and signed reports that a third party can verify without taking your word for it.
What does the AI do, and what does it not do?
AI assists the analysis: it classifies endpoints so probes target the routes that hold user data, plans business-logic tests when a customer enables them, and looks across findings for attack chains. Findings come from real requests to the target, with the evidence recorded in the report. Business-logic results are the model's judgment of those recorded responses, and attack chains appear in their own section without changing severity totals.
Will this satisfy our compliance requirements?
Reports are built for auditor handoff. Findings map to CWE, NIST 800-53 controls, and MITRE ATT&CK techniques, with CVSS v4.0 base scores where a finding type has a reviewed vector, a CISA KEV check of reported CVEs, evidence, and remediation guidance. Human Reviewed reports add a SOC 2, ISO 27001, and PCI DSS evidence crosswalk. Your auditor or client still decides whether the evidence meets their specific requirement.
Can we share reports with clients and auditors?
Yes. Every report includes a stable report ID, version, publisher signature, testing scope, methodology, evidence, remediation guidance, and standards mappings. You can issue expiring, revocable share links, and recipients can verify the report independently.
Can I cancel anytime?
The Continuous plan has a three-month initial commitment and becomes month-to-month afterward. The Human Reviewed plan is annual. Billing and payment methods are managed through Stripe.
Built by Security Professionals
We have spent more than 20 years working with security-conscious clients: organizations where a data breach is not a bad day, it is an existential event. One problem came up again and again. Clients needed third-party security testing to meet a requirement or close a deal, and the quotes were out of reach.
Smoke Test is what we wished existed: real testing that runs continuously, at a price that makes sense, producing reports that the people relying on them can verify for themselves.