Question 1

What is ComplAI VAPT as a Service?

Accepted Answer

VAPT as a Service is Propel Ready’s managed penetration testing offering inside ComplAI Assurance. Engagements follow a seven-phase workflow — scope, plan, automated VA, manual pentest, live findings tracker, formal report, and retest — with client-side scanning at your network edge and findings mapped to your GRC controls.

Question 2

How does client-side automated VA work?

Accepted Answer

Automated vulnerability assessment runs from a ComplAI scan runner at your network edge using tools such as Tenable, Nessus, and Qualys. Scan results sync into the live finding register without shipping raw scan data off-site — keeping breadth-first CVE and hygiene coverage inside your environment.

Question 3

Why a live findings tracker instead of a final PDF?

Accepted Answer

Critical findings surface in real time during active testing so developers can patch on day one. Owners get severity, reproduction steps, and Jira or ServiceNow tickets immediately — instead of waiting weeks for a static report after the test window closes.

Question 4

How does VAPT connect to ComplAI Assurance and ASM?

Accepted Answer

VAPT engagements live alongside SAST, DAST, infra, and cloud findings in ComplAI Assurance. Open vulnerabilities feed the leadership dashboard, and teams can combine managed VAPT with ComplAI ASM outside-in monitoring for defense-in-depth visibility.

Question 5

When should we use VAPT as a Service?

Accepted Answer

Common drivers include ISO 27001 and SOC 2 annual penetration tests, PCI-DSS assessments, pre-release security gates, M&A diligence on acquired platforms, and complementing continuous ASM with point-in-time manual exploitation of business-logic flaws automated scanners miss.

VAPT

Overview

Who it's for

Key capabilities

Other solutions