Skip to main content
AQIRA
Book a demo
AQIRA

Menu

Book a demo

360° security testing. Evidence you can verify.

Hack yourself before the hackers do.

AQIRA penetration-tests your web apps, APIs and Android apps, and audits cloud accounts, code and Microsoft 365 or Google Workspace tenants. Exploitable findings carry benign proof and an ATT&CK mapping.

Book a demoSee the live console

Non-destructive at every intensity. Read-only access wherever an input allows. Nothing active runs until you confirm authorisation. How AQIRA stays safe

AQIRA consoleDashboardProduct UI, demo data
The AQIRA dashboard in the dark theme: the portfolio risk gauge, critical findings, targets assessed, risk over time and what drives the score.The AQIRA dashboard in the light theme: the portfolio risk gauge, critical findings, targets assessed, risk over time and what drives the score.

Less noise. More certainty.

A list of possibilities is not a security programme.

The annual test

An annual penetration test describes the estate as it stood that week. After the next release, DNS change or cloud account it is out of date, and the next test is months away.

The scanner

A scanner runs more often but ranks possibilities by score, not by what an attacker could do. Your team spends days disproving the list before real issues are fixed.

The continuous assessment

AQIRA covers the gap. It assesses every input you own on the schedule you set. Exploitability is validated with benign proof, and each finding carries evidence and a confidence level. The report can be checked line by line.

How it stays safe

How proof stays benignSecurity and access

  • Benign markers

    Proof is a unique marker the target echoes back, a measured delay, an out-of-band lookup or the output of a read-only command.

  • Authorised targets only

    Every active assessment and every schedule starts with the operator confirming they are authorised to test the target.

  • You can stop it

    Pause, resume or cancel any assessment from the live console; it holds or stops at the next safe checkpoint. Schedules pause and resume too.

AQIRA in numbers

  • 6input types
  • 6agents
  • 416ATT&CK techniques and sub-techniques cataloguedMITRE ATT&CK v15.1
  • 12compliance frameworksPlus OWASP MASVS for mobile
  • 8report templates
  • 4export formatsHTML, PDF, JSON, CSV

Each number is the length of a list in the console. None of them is a result.

360° coverage

Six inputs. One clear view.

Six inputs assessed from one console, with threat and dark web intelligence beside the findings. Brand intelligence is in development.

From scope to sign-off

A clear handoff. At every step.

Five assessment phases, then a report. Each specialist carries the evidence forward, so your team can follow how a finding became a conclusion.

Follow a real example

Shown for a domain assessment. The work changes with the input.

01ORION / ReconMap the attack surface

Maps the public attack surface.

In the consoleCorrelating certificate transparency and passive DNS for acme.example

On a cloud account, ORION assumes the read-only role and inventories the account.

02VEGA / WebTest web apps and APIs

Probes web and API input handling, sessions and headers.

In the consoleReflected marker AQIRA-MARKER-web observed on /search; recorded as evidence, not exploited

On a code repository, VEGA traces taint through the code and hunts committed secrets.

03ATLAS / InfraCheck the infrastructure

Assesses cloud, transport and the internal segment.

In the consoleEnumerated TLS configuration and exposed database listeners

On an Android app, ATLAS inventories bundled SDKs and reviews cryptography.

04NOVA / ExploitValidate with benign proof

Validates exploitability to benign proof.

In the consoleValidating exploitability with benign probes; no state-changing requests

On a Microsoft 365 tenant, NOVA validates identity attack paths to benign proof.

05POLARIS / ReviewReview and map the findings

Consolidates findings and maps them to control frameworks.

In the consoleMapping findings to ATT&CK, OWASP, NIST CSF, 800-53, 800-171 and COBIT

On every input, POLARIS also scores the input's framework: MASVS (Android), CIS (cloud), CIS and SCuBA (tenants).

06SCRIBE / ReportWrite the report

Writes the client-deliverable report.

In the consoleReport v1 ready

On every input, SCRIBE writes the report from the evidence, in the chosen template and format.

Live console

Every phase on screen, while it runs.

The live console shows the phase in progress, the assets found and findings arriving with their evidence. Below, a finished assessment of the demo domain acme.example.

  1. ORION works outward from the root domain through certificate transparency, passive DNS and public hosts, recording how each asset was found.

  2. VEGA tests input handling, sessions and headers with marker payloads only. A reflected marker is recorded as evidence, not exploited.

  3. ATLAS checks transport, exposed services and cloud storage, then follows them inward; each bucket, database listener and internal host lands in the live feed.

  4. NOVA validates exploitability with benign probes and no state-changing requests. Each finding arrives with severity, evidence, fix and confidence level.

  5. POLARIS consolidates the findings, scores the risk and maps each to ATT&CK, OWASP, NIST and COBIT; SCRIBE writes the report from that evidence.

AQIRA consoleLive console / acme.exampleProduct UI, demo data
The main column of the AQIRA live console for a finished assessment of acme.example, from the phases and agent fleet down to the analytics.The main column of the AQIRA live console for a finished assessment of acme.example, from the phases and agent fleet down to the analytics.

  1. 01ReconORION

    Map what an attacker can reach

    ORION works outward from the root domain through certificate transparency, passive DNS and public hosts, recording how each asset was found.

    AQIRA consoleLive console / acme.exampleProduct UI, demo data
    The live console's phase track and agent fleet, with ORION's card marked: its role, the capabilities it used and the findings it contributed.The live console's phase track and agent fleet, with ORION's card marked: its role, the capabilities it used and the findings it contributed.

  2. 02WebVEGA

    Probe the web apps and APIs

    VEGA tests input handling, sessions and headers with marker payloads only. A reflected marker is recorded as evidence, not exploited.

    AQIRA consoleLive console / acme.exampleProduct UI, demo data
    The live console's agent fleet with VEGA's card marked: probing web and API input handling, sessions and headers, and checking framework versions against the advisory feed.The live console's agent fleet with VEGA's card marked: probing web and API input handling, sessions and headers, and checking framework versions against the advisory feed.

  3. 03InfraATLAS

    Follow it into the infrastructure

    ATLAS checks transport, exposed services and cloud storage, then follows them inward; each bucket, database listener and internal host lands in the live feed.

    AQIRA consoleLive console / acme.exampleProduct UI, demo data
    The live console's run log beside the live discoveries feed, marked: an internal host, a cloud storage bucket and three services.The live console's run log beside the live discoveries feed, marked: an internal host, a cloud storage bucket and three services.

  4. 04ExploitNOVA

    Prove it with benign probes

    NOVA validates exploitability with benign probes and no state-changing requests. Each finding arrives with severity, evidence, fix and confidence level.

    AQIRA consoleLive console / acme.exampleProduct UI, demo data
    The live console's live findings panel, marked: a critical finding with its confidence, CVSS score, affected asset, evidence status and remediation.The live console's live findings panel, marked: a critical finding with its confidence, CVSS score, affected asset, evidence status and remediation.

  5. 05ReviewPOLARIS

    Consolidate, map and report

    POLARIS consolidates the findings, scores the risk and maps each to ATT&CK, OWASP, NIST and COBIT; SCRIBE writes the report from that evidence.

    AQIRA consoleLive console / acme.exampleProduct UI, demo data
    The live console's analytics after the run, marked: findings per phase by severity, beside the phase timeline and the severity chart.The live console's analytics after the run, marked: findings per phase by severity, beside the phase timeline and the severity chart.

Start an assessment from any input

Each input starts from the same New assessment step, runs five phases of its own, and lands in one console and one report.

Domains, web apps and APIs

AQIRA consoleNew assessmentProduct UI, demo data
The AQIRA live console for a domain assessment of globex.example: five phases, each marked done by its agent, above the agent fleet.The AQIRA live console for a domain assessment of globex.example: five phases, each marked done by its agent, above the agent fleet.
AQIRA's New assessment dialog with Domain selected: a hostname field, the three intensities from passive reconnaissance to deep, and the authorisation checkbox.AQIRA's New assessment dialog with Domain selected: a hostname field, the three intensities from passive reconnaissance to deep, and the authorisation checkbox.
You provide
A domain. The agents work outward to the subdomains, hosts, services and APIs an attacker could reach.
Access
Nothing to grant. The operator confirms authorisation for the target before anything active runs.
Scored against
OWASP Top 10, NIST CSF 2.0, NIST SP 800-53, NIST SP 800-171 and COBIT

The five phases

  1. Reconnaissance
  2. Web and API Security
  3. Infrastructure and Configuration
  4. Exploitability Validation
  5. Review and Reporting
Web and API in detail

On every input, findings are also mapped to ATT&CK, OWASP, NIST CSF, NIST SP 800-53, NIST SP 800-171 and COBIT, and land in one console and one report.

Evidence and PoC, Reproduce, Remediation, Mappings

Evidence on every finding, benign proof on every exploit

Each finding carries evidence, read-only steps to reproduce it, benign proof where an exploit was validated, remediation in priority order, and its ATT&CK technique and MITRE's mitigations where one applies. Below: a SQL injection from the demo assessment of acme.example, tab by tab.

Evidence and PoC

The request and the response

The request and response, with the benign marker highlighted in both: proof the input reaches the query without taking anything from the database.

An AQIRA finding for SQL injection, on Evidence and PoC: CVSS 9.8, the request carrying a benign marker and the error response that echoes it.An AQIRA finding for SQL injection, on Evidence and PoC: CVSS 9.8, the request carrying a benign marker and the error response that echoes it.
Product UI, demo data
  1. CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HThe 9.8 score carries the vector it was computed from.
  2. Benign proofAQIRA-MARKER-sqliOne stray quote, echoed back in the database error. No timing probe, no data extracted.

Reproduce

Steps your team can repeat

Read-only steps in order, each with the request to send and the response to expect, to confirm the finding before the fix and after it.

The Reproduce tab of an AQIRA finding: the precondition, then two read-only requests, each with the response to expect.The Reproduce tab of an AQIRA finding: the precondition, then two read-only requests, each with the response to expect.
Product UI, demo data
  1. Steps to reproduceTwo read-only requestsThe precondition first, then each request as a copyable command.
  2. Expected resultHTTP 500, then HTTP 200The quoted marker breaks the query; unquoted, it does not.

Remediation

A fix list in priority order

Contain, fix the root cause, then harden. Each step carries a priority and an effort; the fix includes the code change.

The Remediation tab of an AQIRA finding: P0 overall, an interim WAF rule at P1, then the query rewritten with bound parameters at P0.The Remediation tab of an AQIRA finding: P0 overall, an interim WAF rule at P1, then the query rewritten with bound parameters at P0.
Product UI, demo data
  1. Remediation priorityP0 overallA WAF rule at P1 contains it today; rewriting the query at P0 closes it.
  2. The fix, in codeBound parametersA prepared statement in the application's own language, ready to copy.

Mappings

Mapped for every reader

The ATT&CK technique and MITRE's mitigations for the SOC, the CWE and OWASP category for developers, and the controls it touches for your auditors.

The Mappings tab of an AQIRA finding: ATT&CK technique T1190, weakness CWE-89 and OWASP A03:2021, and its controls in COBIT and NIST.The Mappings tab of an AQIRA finding: ATT&CK technique T1190, weakness CWE-89 and OWASP A03:2021, and its controls in COBIT and NIST.
Product UI, demo data
  1. ATT&CK mitigationsT1190: M1016, M1026, M1030, M1048, M1050, M1051The technique links to MITRE's own mitigations, from vulnerability scanning to updating software.
  2. Compliance controlsCOBIT, NIST CSF 2.0, SP 800‑53, SP 800‑171The same finding in each framework's terms: BAI03, PR.PS-06, SI-10, 3.14.1 and more.

ATT&CK, compliance, reports, portfolio, enterprise

Mapped, reported and governed

The same evidence feeds the rest of the console. Each part is set out in full, with its captures, on the platform page.

  • 416 techniques and sub-techniques

    Attack paths mapped to MITRE ATT&CK

    Each finding maps to an ATT&CK technique, with kill chains in tactic order and MITRE's mitigations for every technique reached.

  • 12 frameworks

    Compliance mapping

    Findings map to named controls, each with a status, an owner and evidence, updated on every scheduled assessment.

  • 8 templates

    Reports a client can sign off

    Written from the same evidence the console shows, and exported as HTML, PDF, JSON or CSV.

  • One scale

    Risk across every input

    A portfolio score, what drives it, how it moved and which reports are ready.

  • SSO, audit trail, vault

    Built to sit inside a security programme

    Single sign-on, an audit trail, schedules, collectors and a vault that keeps no copy of an upload.

Product UI, demo data.

FIRST EPSS, credential exposure

Threat and dark web intelligence beside your findings

Findings show the weakness; the Threat Intel module shows the pressure around it. Two parts run on live data today: EPSS on every CVE in your findings, and the credentials AQIRA's assessments find exposed.

AQIRA's threat geography: a world map with a bubble per country sized by observed activity, and Russia's activity, indicators and ATT&CK groups beside it.AQIRA's threat geography: a world map with a bubble per country sized by observed activity, and Russia's activity, indicators and ATT&CK groups beside it.
Product UI, demo dataThe threat geography in the console. Its actors and indicators show sample data until their feeds are connected.

  • Exploitation pressure

    FIRST EPSS probability on every CVE across your findings, read live from FIRST.

    KEV listings, indicators, actors and the map show sample data until their feeds are connected.

  • Credential exposure

    Credentials exposed in your estate, found by AQIRA's assessments, the secret itself never shown.

    Breach, paste, forum and dark-web records show sample data until live monitoring is connected.

  • Brand intelligence

    In development

    Lookalike domains, typosquats and impersonating profiles. Not in the console yet.

The whole Threat Intel module, with the map

Where scope ends

The honest limits

A clean result covers only what AQIRA tests. What it does not do, and how its proof stays benign.

  1. It is not a penetration test with a person in it.

    A clean assessment states what was tested, at one moment, not that an estate is secure.

  2. It does not find business logic flaws.

    Those need someone who understands what the application is for.

  3. It does not test behind a web login.

    Web and API assessments cover what the internet reaches without signing in.

  4. It does not assess people.

    No phishing, no social engineering and no physical access testing.

  5. It does not reach internal networks on its own.

    Only through a collector you install, and only the private networks you authorise.

  6. It does not ask for write access.

    Read-only roles, tokens and consent, granted and revocable on your side.

  7. It assesses Android apps, not iOS apps.

    Mobile assessments take an Android package (APK) and map findings to OWASP MASVS.

How proof stays benign

  • Benign markers

    Proof is a unique marker the target echoes back, a measured delay, an out-of-band lookup or the output of a read-only command.

  • Non-destructive at every intensity

    Standard runs safe proofs of concept; Deep chains steps to prove impact, still non-destructive; Reconnaissance sends no attacks.

  • Steps your team can repeat

    Each finding lists read-only steps to reproduce it, with the response to expect.

  • Authorised targets only

    Every active assessment and every schedule starts with the operator confirming they are authorised to test the target.

  • You can stop it

    Pause, resume or cancel any assessment from the live console; it holds or stops at the next safe checkpoint. Schedules pause and resume too.

Shipped, month by month

What has shipped

Each capability in the month it reached the console, dated from the product's own history.

Design partners

Design partners run AQIRA on their own estate and work directly with the team building it.

Become a design partner

  1. The assessment workspace

    Findings, ATT&CK coverage, compliance and run history for every assessment, and a live console that follows each agent.

  2. Schedules and collectors

    Assessments that repeat on a schedule, and collectors for internal networks, enrolled with a one-time token.

  1. Single sign-on

    Sign-in through your own identity provider over OpenID Connect, with audit-ready tables across the console.

  2. In-depth findings

    CVSS vector, CWE, steps to reproduce, benign proof, remediation and ATT&CK mitigations on every finding.

  3. All six inputs

    Each of the six inputs starts and follows a full assessment in the console.

  4. The report engine

    Report templates for every reader, exported as HTML, PDF, JSON or CSV, with your colours and logo.

  5. Portfolio dashboard and typed schedules

    Risk and its trend across every assessment, and schedules that target cloud accounts, repositories and tenants.

Product screens on this site show demo data.

Three plans, sized to your scope

Standard is priced per domain. Premium puts web, Android, code and cloud on one plan, and Enterprise covers every input at scale. Pay monthly, or yearly with 2 months free.

See plans and pricingTalk to sales

  • Standard

    From USD 299 a month per domain

    Priced per domain: your web app and API, tested every month, with benign proof and a retest.

  • Premium

    From USD 1,490 a month

    Web, Android, code and cloud on one plan, with Deep testing, weekly schedules and compliance evidence.

  • Enterprise

    From USD 6,000 a month

    Every input at scale on a dedicated deployment, with SSO, an SLA and AQSEC expert days.

Monthly prices, on a 12-month term. Yearly, AED and PKR prices are on the pricing page. All prices exclude VAT and other taxes.

Frequently asked questions

For anything else, write to hello@aqsec.co.

Do we need permission to run a penetration test with AQIRA?

Yes: only what you own or have written permission to test. Every active assessment and every schedule asks the operator to confirm they are authorised to test the target. A collector reports only on the private networks its owner authorises.

Reconnaissance, which maps the attack surface from public sources without sending attacks, needs no authorisation. For cloud accounts and workspace tenants, the read-only grant in your own console is the authorisation.

How authorisation works

Can we pause or stop an assessment?

Yes. From the live console you can pause, resume or cancel any assessment; it holds or stops at the next safe checkpoint. A schedule can be paused and resumed too.

Who runs AQIRA: our team or AQSEC?

Your team. AQIRA runs in the console, and nothing is tested until an operator on your side starts an assessment and confirms authorisation for the target. The same operator can pause, resume or cancel it.

AQSEC, the team that builds AQIRA, agrees the scope with you on a scoping call when a plan starts, and arranges a quarterly cadence on any plan if you want one.

What each plan includes

What happens to the data and credentials we give AQIRA?

Uploads go through the vault: an Android package is hashed and its structure checked as it streams in, and never stored or run. Access tokens are digested, so the console never shows one back.

Cloud accounts, repositories and workspace tenants are read through read-only roles, tokens and consent you grant and can revoke. Findings, evidence and reports stay in the console for your team.

What AQIRA asks for, and what it keeps

How does AQIRA compare to a manual penetration test?

A manual test brings a person who can reason about your business; AQIRA brings frequency and consistency. It runs the same five phases on every input and writes the report from its evidence. Every input except an Android package can repeat on a schedule, monthly to daily by plan, so testing becomes a continuous programme.

It does not replace a tester for business logic, testing behind a web login, social engineering or physical access.

How is AQIRA different from a vulnerability scanner?

A scanner returns possibilities ranked by a score. NOVA validates exploitability and attaches benign proof: what reaches your team is what an attacker could do, with evidence and read-only steps to reproduce it.

What does benign proof of exploit mean?

The smallest non-destructive evidence that a weakness is real: a unique marker the target echoes back, a measured delay, an out-of-band lookup or the output of a read-only command.

Every intensity is non-destructive, including Deep, which chains steps to prove impact.

What can AQIRA assess?

6 kinds of input: domains with their web apps and APIs, Android APKs, AWS, Azure and GCP accounts, code repositories, and Microsoft 365 and Google Workspace tenants; internal networks through a collector inside them.

What formats do reports come in?

There are 8 report templates, and a report exports as HTML, PDF, JSON or CSV, written from the evidence.

Can we sign in with our own identity provider?

Yes, on Enterprise, which runs on a dedicated deployment: the console supports single sign-on with your provider over OpenID Connect.

Signing out of AQIRA also ends the session at your provider, so the next sign-in asks for your password again.

How is AQIRA priced?

Three plans, Standard, Premium and Enterprise, billed monthly on a 12-month term or yearly with 2 months free. Standard is priced per domain. Premium puts web, Android, code and cloud on one plan. Enterprise starts from a published price, with a quote for your scope.

The pricing page lists every price in USD, AED and PKR, with the full comparison and the add-ons.

See plans and pricing

Next step

See AQIRA run an assessment, end to end

A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.

Book a demo