Argus Pentest logs in first. A scripted sign-in through the same credential store the QA engine uses hands the scanner real session cookies and a bearer token, and the endpoints discovered on the way seed its API spec — so the scan runs across the authenticated surface, where the findings that matter actually are.
An unauthenticated scan sees the marketing shell and the sign-in form. The business logic, the roles and the interesting data all sit behind that form.
A manual penetration test happens on an annual cycle while the application ships every sprint, so most releases go out with no security check at all.
Raw scanner output arrives as a long list of maybes, and the work of separating the real from the theoretical falls on a team that does not have the hours.
Authenticated scanning means handing a third party working logins to an internal system — which a regulated organisation cannot do.
A scripted login yields session cookies and a bearer token from the encrypted credential store, so the scanner works the application as a real signed-in user.
Endpoints discovered during login and crawling are assembled into a synthesized API spec, so the scan reaches routes no unauthenticated crawl would ever see.
Scans run against an explicit allow-list. A target has to be added deliberately before anything can be pointed at it.
The engine underneath is Deep Eye, driven only through its CLI contract — so it can be upgraded or swapped without touching the platform around it.
Every finding is re-checked against the live target before it reaches the totals. One that cannot be stood up is quarantined, kept but not counted; a scan that never got past the login is marked inconclusive rather than reported as clean.
Self-hosted alongside the other two engines: the credentials, the scan traffic and the reports all stay on your own infrastructure.
Reach the authenticated surface on every release instead of once a year, and spend the time on real findings rather than on getting a scanner logged in.
Evidence that the application was security-tested before it shipped, produced without sending credentials to a third party.
Reuse the credentials and target configuration already set up for regression testing — one platform, one credential store.
Run it inside your own perimeter, with the scanner engine treated as a replaceable dependency.
Authenticated scanning is the differentiator. Anyone can scan a public page; reaching the roles, forms and APIs behind a sign-in is where the findings live.
It signs in with the accounts already set up for each environment, and picks its model in the same Settings as the other engines — set up once, used by all three.
Working logins to an internal system never leave your infrastructure, which is the only way authenticated scanning is possible in a regulated industry.
It is shipped and running, but it has not yet been measured against unauthenticated scanning on the same targets, and per-scan cost accounting is still missing. We would rather say so than imply a number we have not taken.
In Greek myth, Argus Panoptes was the giant with a hundred eyes who never slept — the all-seeing watchman. The pentest engine is the half of that watch that looks for the way in: not whether the application works, but whether someone who should not be inside can get there.
Argus Pentest only scans what you have explicitly approved: a target must be added to an allow-list before it can be pointed at, and the credentials it authenticates with are yours, held in your own encrypted store. A scanner that cannot log in reports an environment failure rather than a security finding — the same honest-failure rule the QA engine applies, because a false alarm costs a security team more than a missed scan.
The QA, AI and pentest engines run in one deployment behind one console and one sign-in. They share a browser layer, an encrypted credential store and a model router whose model each engine picks in Settings — so accounts, environments, models and deployment are set up once for all three.
Drives your business workflows through the real interface and reports what broke, with a screenshot and a stated reason behind every step.
Runs thousands of synthetic users against your assistant and scores every conversation with an Azerbaijani-native judge.
Scans your approved targets as a logged-in user, so the check reaches past the login wall, and reports findings by severity.
Allmaz is the AI product studio of Smart Solutions, which built and operates Azerbaijan's unified public procurement portal — established by presidential decree and delivered as one of the country's first public-private partnerships in digital government.
Request a demo to see an authenticated scan reach the surface behind your own login.