Introduction to XBOW Console

XBOW Console provides automated penetration testing for web applications and their APIs. The platform identifies security vulnerabilities by using AI to send requests to test your asset.

What to expect from XBOW testing

XBOW systematically tests the web pages and API endpoints of your asset, searching for security vulnerabilities. The platform validates exploitable vulnerabilities and provides evidence-based findings to help you prioritize the most urgent findings to fix.

Comparison with manual penetration testing

If you are testing an asset that has recently undergone manual penetration testing with no reported issues, XBOW may produce similar results. However, automated testing enables faster turnaround times and broader attack coverage than most manual tests, and may identify vulnerabilities that were not detected by manual testing.

Test result quality depends on asset quality

Assets that are unstable, incomplete, or use end-of-life infrastructure may produce limited or unreliable results. For the best results, test assets that are internet accessible, fully functional, and maintained with current security practices.

Why you should trust XBOW with your asset

XBOW takes many steps to manage your data and assessment securely, including:

  • Constant data encryption and regular audits for continued SOC 2 Type 1, SOC 2 Type 2, and HIPAA compliance
  • Automatic and configurable security measures to keep your asset safe during an assessment
  • An audit trail of assessment activity

For more information, see Trusting XBOW to assess your asset.

Data residency

This feature is in Private preview and subject to change. It is available only on multi-tenant SaaS.

Data residency is offered in Australia, Canada, Europe, Japan, and Singapore.

Each organization uses one region, and the choice is permanent. To get started, contact the XBOW sales team. They confirm availability and provision your organization, and you then onboard at your regional Console URL.

For more information, see Meet data residency requirements. For regional URLs, see Data residency.

Next steps

Was this helpful?