GovernancePenetration Testing

Penetration Testing

Connect Striker to Aegis to pull your VAPT scans and findings into your compliance program, promote a finding straight into your risk register, and file a scan report as penetration-test evidence.

A penetration test is one of the artifacts almost every framework and every serious customer asks for, and it usually lives outside the compliance program: a PDF in a shared drive, findings re-typed into a spreadsheet, a report nobody remembers to refresh. Aegis pulls it in. Connect Striker, NexusVoid's VAPT product, and your scans, findings and reports become part of the same program as your controls, risks and evidence.

Aegis does not run the scan itself. Striker does the testing; Aegis reads it and turns it into governance: a finding you can promote to your risk register, a report you can file as evidence, a clean result you can publish on your Trust Center.

Where it lives

Security → Penetration Tests in the Aegis sidebar. The Security section is visible to members with the pentest:read permission (owners and admins by default); an auditor sees it read-only.

Connect Striker

Connecting is one click, no key to copy and paste:

Start the connection

On the Penetration Tests page, choose Connect Striker. Aegis opens Striker's OAuth consent screen.

Approve read-only access

Sign in to Striker if needed and approve. Aegis requests read scope only.

You're connected

Aegis stores a scoped, read-only token and the page fills with your scans. Revoke it anytime in Striker under Settings → API Keys → Connected apps; the connection also shows in Aegis under Integrations.

The token Aegis holds is read-only: it can pull your scans, findings, reports and attestations, and nothing else. Aegis never modifies data in your Striker account. You run and manage scans in Striker; see Striker → Getting Started.

What you see once connected

  • Remaining scan credits, so you know how many scans the account can still start.
  • Your scans — target domain, status, finding count and a severity breakdown (Critical / High / Medium / Low / Info) for each.
  • Findings — title, severity, CVSS and the affected URL, across your scans.
  • Reports — for any scan whose report is ready, open the current technical PDF with View report. Striker's report links are short-lived signed URLs, so Aegis fetches a fresh one each time rather than storing a link that would expire.

Bring a finding into your risk register

A pen-test finding is a risk you already know about; it should live in your register, not a separate PDF. On any finding, choose Promote to Risk. Aegis creates a risk in your risk register, pre-filled from the finding:

  • Severity mapped to impact and likelihood — a Critical finding lands as a severe, likely risk; an Info finding as an insignificant, very-unlikely one.
  • The technical detail carried across — CVSS, CWE, CVE, OWASP category, the affected URL and the recommended remediation, so the risk is actionable, not a one-line stub.
  • Categorized as a technology risk, ready for an owner.

From there it behaves like any Aegis risk: AI-mapped to the controls that mitigate it, given treatment tasks, and scored for residual risk as you close them.

File a report as evidence

When a scan's report is ready, choose Save as evidence. Aegis files a penetration-test evidence submission against your program, the standalone artifact an auditor expects to see, and the one tracked on your Documents checklist. The submission records the scan reference and its severity summary; the PDF itself is fetched on demand through Aegis when someone opens it, so what you hand an assessor is always a live report, never a dead link.

Publish a clean result

When a scan comes back clean, with 0 Critical, High or Medium findings, Striker issues a verifiable attestation. Feature it on your Trust Center as independent proof of a penetration test, so a prospect's security team can confirm it without emailing you the full report. See Striker → Trust & Attestations.

What this feature does not do

  • It does not run the scan. Aegis pulls results from Striker; you start scans, verify domains and buy credits in Striker. See Getting Started and Pricing.
  • It reads, it does not write. Promoting a finding or saving a report creates records in Aegis. Your Striker scans and findings are never altered from here.
  • It needs a Striker account with credits. No account or no credits means nothing to pull; the page shows a Connect prompt or an empty state accordingly.

Next steps

Risk Management

Where promoted findings land and get treated.

Evidence & Tasks

Where a saved report lives on your Documents checklist.

Trust Center

Publish a clean scan's attestation as proof.

Striker (VAPT)

The product behind the scans, and how to run one.

Contact us

Was this page helpful?