Find real vulnerabilities in your web apps and APIs, ranked by live exploit intelligence, gate them in CI, and hand your auditor the report. All from one platform.
Passive checks, active exploitation probes, dependency analysis, and live threat intelligence in one scan you run on demand, on a schedule, or from CI.
Reflected and DOM XSS, injection, authentication and access-control checks, TLS and security-header analysis, and port and service discovery. All crawl-aware, spec-driven for APIs, and ranked by real-world risk.
Enriched from NVD, the CISA KEV catalog, and EPSS, so you fix what is exploited first.
Known ExploitedFind vulnerable and outdated dependencies, checked against OSV and mapped to advisories with fixes.
Schedule scans, set a baseline, and get alerted the moment a new vulnerability appears.
Fail the build on new criticals, and upload SARIF straight to your code-scanning tab.
Native MCP support lets AI agents run scans and read results. Push alerts to Slack, Discord, or Jira.
No agents to install and no infrastructure to stand up. Point Vlume at a target you own and it does the rest.
Register the web app or API you own and prove control with a DNS record or a file. Scope checks and an SSRF guard refuse internal or unauthorized hosts by default.
Launch from the dashboard, wire the CLI into CI, or let an agent trigger it. Set a schedule for continuous coverage of every release.
Review findings ranked by real-world risk, fail the build on regressions, and export the report your auditor asks for.
$ vlume ci --target app.acme.io --fail-on high --sarif vlume.sarif vlume starting authorized scan of app.acme.io -> passive checks, active probes, CVE intel, SCA ok crawled 128 routes in 41s Findings critical 1 reflected XSS /search?q= high 2 outdated dependency (KEV) medium 5 missing security headers FAIL new findings at or above high (threshold: high) report written to vlume.sarif exit code 1
Every finding is mapped to the control frameworks your program is measured against, then rendered as a report you can export and hand over. No spreadsheet gymnastics.
A built-in toolkit for the manual work automation cannot do. Every request is host-locked to a verified target and SSRF-guarded.
Craft and replay a single request against a target, then read the full response.
Fuzz an injection point with a payload list and compare status, length, and timing.
Encode and decode Base64, URL, hex, and HTML, and crack open JWTs in a click.
Diff two responses line by line to spot exactly what a payload changed.
Every plan includes the full scanner. Higher tiers add targets, scan volume, deeper crawls, and advanced modules.
Vlume is built to run only against your own assets and to leave a clean record of everything it did.
Start scanningOwnership verification, scope checks, and an SSRF guard block internal and unauthorized hosts.
Every state change is recorded per account: who, what, when, and from where.
Owner, admin, member, and viewer roles, optional TOTP, and encrypted stored credentials for authenticated scans.
The who-did-what record and framework-mapped reports map directly to SOC 2 and ISO 27001 asks.
Vlumeaware sends realistic phishing simulations to your own staff. A click can lead straight to a short lesson and quiz, and people who pass earn a certificate. Reports track click and report rates over time, with a per-person risk score that shows who needs the next lesson.
The free trial runs for 7 days and covers up to 20 employees. You can set everything up straight away, and live campaigns unlock once Vlumetech approves your account.
Prices in naira, per enrolled employee per month. Rates are graduated: the first 50 employees are ₦1,500 each, the next 200 are ₦1,200 each, and so on. A team of 60 pays ₦87,000 a month.
Run your first scan free in the next five minutes. No credit card, no sales call.
Tip: press / in the dashboard to jump straight to a scan.