A SaaS security review can be misleading if it compares vulnerability totals without also taking into account the scan scope. A source-code review, an authenticated assessment of the infrastructure, and a scan from outside the web address different areas. A fewer number of vulnerabilities might indicate better security, narrower coverage, or simply a lack of access.
Vulnerability scanning tools may be used to produce technical evidence when an investment, acquisition, partnership, or supplier review is taking place. However, they are not capable of showing the full security position of a business. The six options here relate to different aspects of the evidence portfolio, ranging from application code to exposed infrastructure. They must be used with clear authorization and together with a documented list of both what was and what was not assessed.
At a glance
| Aikido Security | Application-to-cloud evidence | Unified software scanning |
| Tenable Nessus | Authenticated infrastructure assessment | Host vulnerability checks |
| Qualys VMDR | Ongoing asset assessment | Vulnerability lifecycle management |
| Rapid7 Exposure Command | Infrastructure risk context | InsightVM vulnerability engine |
| Invicti | Running application evidence | Proof-based dynamic testing |
| Intruder | Lean external exposure reviews | Continuous vulnerability monitoring |
1. Aikido Security — Application-to-cloud evidence
Aikido Security combines code, dependency, container, and cloud security capabilities. It is a strong option for an authorized technical review where the company can provide access to its development and deployment environments, rather than only allow an external scan.
The value lies in having a wider perspective on the relationship between software issues and the product that is being maintained. You should record which repositories and cloud accounts were linked and distinguish between confirmed findings and coverage gaps. While a platform report can assist with due diligence, it does not constitute an independent audit opinion or serve as a replacement for looking at the security processes and historical incidents.
2. Tenable Nessus — Authenticated infrastructure assessment
Tenable Nessus is a vulnerability assessment tool which can be used for infrastructure and for various systems, including those that require authenticated scanning. It is the appropriate choice in cases where it is necessary to have evidence regarding servers, the software that has been installed and the configuration rather than relying solely on the proprietary application logic.
In the report it is necessary to distinguish between authenticated and unauthenticated results since missing credentials can have a material effect on what can be established during the assessment. You should agree with the operator on the safe scanning conditions, keep the scope and scan date unchanged, and avoid taking a clean infrastructure report as proof that the SaaS application correctly enforces customer permissions.
octopusintelligence.com | Article 15 / continued
3. Qualys VMDR — Ongoing asset assessment
Qualys VMDR includes features for asset discovery, carrying out vulnerability assessments, prioritising vulnerabilities, and providing workflows focused on remediation. The solution should be considered if a business requires an ongoing vulnerability management program rather than just a vulnerability assessment taken at a particular point in time.
In order to carry out due diligence, you should evaluate the quality of the asset inventory and the record of remediation. You need to check that the systems which support the product under review are included in the reported estate. A sophisticated dashboard loses its credibility if the key environments are outside the scope of the dashboard or if important exceptions have no documented owner and no stated expiry date.
4. Rapid7 Exposure Command — Infrastructure risk context
Rapid7 has incorporated its InsightVM vulnerability management features into Exposure Command. This product is appropriate in cases where there is a need to examine evidence of infrastructure vulnerabilities and to see how the company prioritises remediation.
When carrying out procurement refer to the current product scope not an older standalone label. While carrying out diligence, compare the open findings with the team’s response history and coverage records. The most valuable evidence is that which illustrates how a serious issue was identified, allocated, corrected and then rechecked—not merely the number of items still shown on a dashboard.
5. Invicti — Running application evidence
Invicti offers dynamic security testing of web applications and APIs, including proof-based verification of the findings it identifies, as well as a range of application security features. It should be included on the shortlist in cases where the review requires evidence from the actively running SaaS application.
Provide the authorized test accounts and list the areas that have been authenticated as part of the assessment. Although a finding supported by proof can serve as strong evidence of a particular weakness, the absence of any findings in a scan does not mean that all business workflows are secure. The report should regard coverage, authentication success, and excluded functions as essential components.
6. Intruder — Lean external exposure reviews
Intruder offers vulnerability management services for infrastructure, web applications, and APIs; it is appropriate in the case where a smaller team needs a consistent overview of the assets that are exposed and a practical workflow for continuous assessment.
As part of a diligence exercise, you should match the scanned targets with the company’s asset inventory. You need to find out how changes are detected and who looks into any new findings. Although external visibility is helpful, it does not answer questions that can only be settled with internal evidence, such as source-code practices, the use of privileged access, backup recovery, and the way customer data is handled throughout the application.
Compare evidence quality, not scanner totals
For an authorised software-to-cloud view use Aikido, for a focused infrastructure assessment use Nessus, and for an established vulnerability management process use Qualys or Rapid7. Invicti provides evidence relating to running applications, while Intruder is suitable for a lean external assessment workflow.
The diligence summary must include information on the scope, the access level, the date of the assessment, the material findings, the exclusions, and the commitments relating to remediation. It should not combine severity counts from different scanners as if those counts were comparable measures of risk. You should trace the most significant issues back to their effect on the business and request confirmation of any important fixes. While scanning should help in making decisions about investment or selecting a supplier, it should not take the place of more comprehensive operational and security due diligence.
