Governance

Penetration Testing

Automated testing on every release, scheduled external tests, findings tracked to closure and attestation letters

Last automated run

2026-10-25 22:00

every release and weekly

Findings

0 critical

Coverage

186 assets

web, API, network

Next external test

2026-11-18

CREST-accredited firm

Tools in the suite

Tool	Tests	Licence	Last run	Status
OWASP ZAP	Web and API (OWASP Top 10, API Top 10)	Open source	2026-10-25	Passed
Nuclei	Exposure and misconfiguration templates	Open source	2026-10-25	Passed
OpenVAS	Network vulnerabilities	Open source	2026-10-25	Passed
Custom checks	Tenant isolation, RO scope, Whistleblower anonymity	In-house	2026-10-25	Passed

RunRun full suite nowOnly the Client PortalOnly the public API