Does SCARP make changes to production systems?
No. SCARP recommends and verifies changes while your existing owners and work systems govern implementation. A ticket, deployment, or claimed fix never changes measured security state until a re-check observes the result.
Who is SCARP for?
Security leaders who already pay for a scanner and an annual penetration test, answer SOC 2 and customer security questionnaires, and depend on engineering, platform, or IT teams — teams that do not report to them — to change the controls around their critical assets.
What does SCARP cost?
SCARP is a subscription priced mainly on verified domains and assessment volume rather than headcount. We quote each organization in writing before charging; the pricing page explains what drives the number.
Who is SCARP not for?
If what you need is a signed attestation letter for a specific framework, SCARP is not that deliverable. If nobody can get a control change shipped, a shorter list of changes will not help. And if what you want is a complete asset inventory, an EASM product is the better purchase.
What do you need from us to start?
Domains you have verified you own, and a conversation about which assets matter most so we can scope the assessment around them. Nothing is installed, no agents or collectors run in your estate, and nothing is written to your systems.
How is this different from a vulnerability scanner?
Scanners tell you what they found. SCARP shows how an attacker can use those findings to move toward critical assets, then shows which changes disconnect those routes, followed by a re-check after your team ships the fix.
How does SCARP know what sits behind our perimeter?
Only as far as its evidence goes. A run observes what is reachable from the internet: exposed services, sign-in pages, DNS, certificates, and leaked credentials. Where a route continues past what SCARP could observe, that hop is inferred from what was observed and labeled inferred, so you can tell a seen exposure from a modeled one. Nothing is installed inside your network.
Is active scanning safe to run against production?
Active scanning is operator-gated and off by default. Per-target throttling and scan-intensity controls keep authorized assessments inside approved boundaries, and requests are confined to the domains in your authorized scope — never steered at internal or cloud-metadata addresses.
Where does the evidence come from?
Every finding keeps replayable scanner evidence, observation timestamps, and exploitability context, so reports stay tied to the observations that produced them.
How do we know which findings to trust?
Each finding shows the observations behind it — what was seen, when, and how — so you can weigh something SCARP watched directly against a connection it inferred. A report that distinguishes the two is one you can act on; a flat list of scores is not.
Can we bring your last pentest to the walkthrough?
Yes — bring the report and we will map its findings onto your path graph with you on the call, so the paths you already paid to have found are part of the first assessment. Automated third-party pentest import is on the roadmap; until it ships, that mapping is done with you rather than by the pipeline.
How is our data separated from other customers?
Each customer's data is isolated per tenant, enforced in the application and again by row-level security in the database. Access is governed by OIDC SSO and role-based permissions, and every report is scoped to the tenant that owns it.