Automated Security Testing in Your CI Pipeline, Beside Tests
Automated security testing in ZeuZ runs application and server scans, Arachni, Wapiti, Nikto and Nmap, as steps in the same pipeline as your functional tests, and checks authentication, access control and the API surface through the tests you already run. It is not a penetration test; it is the scan that runs on every build so the penetration test finds less.
Automated security testing runs repeatable checks for known classes of weakness, injection, cross-site scripting, misconfigured servers, exposed ports and outdated software, on every build, so they are caught by the pipeline rather than by an annual assessment. ZeuZ runs these scans as test steps beside functional tests, and checks authentication and access control through the same suite, inside your own network where required.
Where security testing breaks today.
Security is a separate team with a separate tool, and its findings arrive in a spreadsheet months after the code shipped.
The annual penetration test finds the same injection and misconfiguration classes every year, because nothing checks them between tests.
Access control is tested manually, if at all, and the viewer who can edit is found by a customer.
How ZeuZ automates security testing.
- 01Test designProposes which scans and access-control cases a change needs from the changed routes, endpoints and roles.
- 02Test case creationDescribe the check in plain English, "a viewer cannot edit a stage", or add a scan step to the set.
- 03Test automationArachni, Wapiti, Nikto and Nmap run as steps; role-based checks run as functional steps against the UI and the API.
- 04Test executionRuns nightly or on every build from a CI webhook, on nodes inside your network, so nothing is scanned from outside it.
- 05Reporting and analysisFindings come back with severity, the affected URL or port and remediation guidance, on the same record as the functional results.
- 06Test maintenanceWhen a route or role changes, the affected cases come back as proposed repairs rather than silent gaps.
Your team reviews what ZeuZ produced. Nothing joins the suite or runs without a person accepting it.
See it run on your application.
Watch Arachni, Nikto and Nmap run as steps beside your own functional tests, live.
Application security testing tools that run as test steps.
Four scanners run as ZeuZ actions. Arachni crawls a web application and sends malicious inputs to find SQL injection, cross-site scripting and file-handling flaws across the OWASP Top 10, returning findings with severity and remediation guidance. Wapiti performs black-box testing by injecting payloads without source access and reports SQL injection, XSS and command-execution flaws with proof-of-concept HTML. Nikto examines a web server’s configuration against a database of more than 7,000 known issues, default files and outdated software, which supports PCI DSS and ISO 27001 hardening audits. Nmap maps hosts, open ports, running services and operating systems, with the Nmap Scripting Engine for custom checks.
Beside the scanners, authentication and role-based access control are tested as ordinary functional and API steps, and secrets in test data stay masked and scoped to people, nodes and tests. Scans run on your own nodes, on-premises or air-gapped, inside the boundary, which is what makes automated security testing usable in the networks that need it most.
- Web app scanning
- Arachni, Wapiti: SQLi, XSS, file and command-execution flaws, OWASP Top 10
- Server scanning
- Nikto: 7,000+ known issues, misconfiguration, outdated software
- Network
- Nmap: hosts, ports, services, OS, NSE scripts
- Access control
- Role-based functional and API checks
- Secrets
- Masked, scoped to people, nodes and tests
- Deployment
- Runs inside your network, on-premises or air-gapped
Runs where your code is allowed to be.
Hosted by ZeuZ, execution on your own machines.
Point the client at your own server.
Disconnected environments, scoped per engagement.
Runs inside Jenkins, GitHub Actions, Azure DevOps, CircleCI and Bitbucket; results into Jira, Slack and Teams.
Works in the same suite as.
The load behaviour of the same endpoints the security scans cover.
Performance testing →Role and access checks against the desktop apps your teams actually run.
Desktop application testing →The API surface the scans probe, tested functionally in the same suite.
API test automation →Read next: Deployment options →Related: Security & compliance policy →
Ready to automate QA testing today?
See ZeuZ Test Studio write, run and repair tests against your own application code.
or explore our services →