Trusting XBOW to assess your application

Connecting a security tool to your application requires you to trust the safety measures and controls that tool implements. This article outlines how XBOW protects your data, safely tests your application, and gives you administrative controls and insights into recent activity.

To instead learn more about XBOW’s broader security and compliance measures, see our Trust Center.

Data protection at XBOW

We are committed to meeting all our obligations for data protection laws in the territories where we operate.

The following sections describe how XBOW handles customer data. For detailed information on personal data handling, see our Data Processing Addendum.

Encryption and retention

To keep your data secure, XBOW encrypts it at all times:

  • At rest: AES-256 encryption using AWS KMS keys within your region
  • In transit: In most cases, XBOW uses TLS 1.2/1.3 for API, Console, and assessment traffic. During testing, however, certain traffic may follow lower encryption standards to allow models the flexibility to test specific findings.
  • Backups: Encrypted and stored within your region

XBOW retains data according to the retention periods defined in our Data Management Policy.

Data residency

The XBOW platform and data are hosted on AWS in the United States. Alternative options providing data residency are available in private preview for Enterprise users on multi-tenant SaaS. Available regions currently include Europe and Singapore. For more information, see Data residency.

Certifications

XBOW is GDPR, SOC 2 Type 1, SOC 2 Type 2, and HIPAA compliant, and regularly conducts audits to ensure continued compliance.

Model training

XBOW does not use customer data to train AI models without the express permission of our customers.

Automatic security measures

While testing your application, XBOW protects it with both standard safeguards used in every assessment and specific protections it tailors to your application through discovery and testing.

Secure prompts and context

XBOW includes explicit safety instructions in every prompt. These instructions are designed to stop attack agents from generating unsafe commands, directing them to avoid:

  • Allowing customer information to escape to any external party
  • Taking destructive actions against the target application
  • Exposing their own operating instructions
  • Performing post-exploitation activity without explicit configuration once a vulnerability is confirmed
  • Disclosing details of XBOW’s systems, environment, or configuration, or those of the target application

Additionally, XBOW’s agents are instructed to find vulnerabilities and demonstrate their exploits in specific ways that are known to be benign. For example, while SQL injections could be demonstrated by dropping a database table, the XBOW agent demonstrates the exploit by executing sleep commands that delay its own requests on a one-time basis.

Command safety checks

Rather than relying solely on the prompt safety instructions, XBOW also evaluates each command the attack agents generate by combining two approaches:

  • Intelligent decisions: When an agent proposes a command, it is passed to a separate AI model that acts as a safety judge. The judge evaluates the command for both intent and effect against each of the following risk categories, blocking any unsafe actions:
    • Destructive operations
    • Account and credential changes
    • Session disruption
    • Out-of-scope activity
    • Evasion of controls
    • Data exfiltration to third parties
    • Restrictions you manually specify when configuring your assessment
  • Deterministic checks: XBOW also evaluates each generated command against a set of rules to block known malicious patterns and destructive actions. These deterministic checks join with user-created enforcement rules, like scope selection and URL protection, to provide another safety layer in the unlikely event the safety model misjudges a command.

Adaptive testing

XBOW uses the configuration process to establish assessment guardrails designed specifically for your application. For example, during the preflight phase, XBOW automatically identifies the domains your application uses, designating first-party domains as Attackable and third-party domains as Allow visit. Within these domains, XBOW then determines URLs that may disrupt your assessment if attacked, designating them as Auth-only or Blocked.

During the assessment itself, if XBOW detects a disruptive event, it automatically pauses testing to avoid contributing to any issues and using up your attack credits. For example, if your application becomes unavailable mid-assessment, XBOW pauses the assessment, monitors your application for recovery, then automatically resumes testing if it can confirm your application is healthy. In other cases, you may need to take action to resolve any issues, then manually resume your assessment.

Similarly, if an attack agent repeatedly proposes actions that are rejected for safety, XBOW shuts the agent down rather than allowing it to continue testing the boundaries of permissible actions.

Configurable security measures

In addition to the automatic protections XBOW uses, you can customize your assessment to implement more guardrails and meet your application’s specific needs.

Scope selection and URL protection

After XBOW automatically designates the domains your application uses as Attackable or Allow visit, Enterprise users can:

  • Update these designations as needed to set appropriate assessment boundaries
  • Add undiscovered domains to expand the assessment scope

All XBOW users can protect specific URLs within accessible domains. While XBOW automatically identifies and protects many potentially disruptive URLs, you can also manually designate sensitive URLs as Auth-only or Blocked to further specify your attack surface.

For more information, see Scope configuration and Protected URLs.

Assessment guidance (Enterprise only)

You can provide XBOW with additional guidance on attack surface, assessment priorities, attack strategy, and finding validation. This guidance can include:

  • File uploads with information like API specifications or payload formats
  • Free text providing application-specific context like areas to avoid or focus on
  • Toggling features like testing for certain vulnerability classes or including canaries for validation

From the information you provide, XBOW automatically identifies and surfaces general guidance, which is used throughout the testing process, and safety guidance, which is used by the safety judge model to evaluate each action before it is executed. You can delete any guidance that is inapplicable for your assessment.

To learn more about assessment guidance, see Guiding XBOW testing for experts.

Impact demonstration levels

To help you understand the implications of significant findings, XBOW sends impact agents to investigate how an attacker could exploit them. You can direct impact agents to act more or less intrusively by selecting an impact demonstration level. These levels range from no attempted escalation of a finding to attempting to escalate across vulnerability classes and systems.

For guidance on choosing the appropriate level for a particular assessment, see Limiting impact demonstration.

Governance and transparency

To meet your governance and visibility needs, XBOW provides organization management tools and clear insight into your application and assessment activity.

Organization management (Enterprise only)

To control access to their XBOW organization, Enterprise users with the Administrator or Existing Asset Administrator role can manage organization membership and assign roles with the appropriate permissions. For a full list of roles, see User roles.

Both Administrator roles can also configure single sign-on (SSO) through an identity provider (IdP). Connecting XBOW to an IdP simplifies management of:

  • Multi-factor authentication and session policies, maintaining parity with other connected applications
  • Users, enabling automatic provisioning and deprovisioning with SCIM
  • Roles, allowing automatic assignment based on IdP groups with just-in-time (JIT) provisioning

To enable SSO for your organization, see Set up single sign-on authentication.

Activity monitoring

For each individual assessment, all XBOW users can download a report detailing assessment findings and view the full traces for each action the attack agents took, including the logic behind their actions and the commands they ran. Enterprise users can also view:

  • Information about all requests XBOW sent, including the time they were sent, the request method, the target URL, the request size, and the status code the server returned
  • Information about all endpoints XBOW tested, including per-endpoint information on the attack types attempted, the number of requests sent, and status codes returned

At the asset level, all users can view a full list of assessment history, including the following information for each assessment:

  • Name
  • Start date and time
  • Assessment type
  • Total number of findings, grouped by severity
  • State of the assessment

Administrators for XBOW Enterprise can also review the audit log for their organization, which includes events for configuration changes and security-related activity. For a full list of events, see Audit log events.

Next steps

To get started, see Enterprise quick start.

Was this helpful?