CyberSpec docs

Reference material for how CyberSpec verifies assets, runs scans, turns results into findings, and maps those findings to compliance controls. The full API reference is still being expanded, but the product workflows below reflect what the platform is designed to support.

Getting started

Add a domain, IP address or CIDR range, prove ownership, accept the scanning authorization for that asset, then run a quick or full scan. Domain verification supports DNS TXT records and a well-known file. IP and CIDR verification uses an attestation tied to a domain already verified in the same account.

Read about network scanning

Findings and triage

Scan results are deduplicated across runs so repeated exposure updates first-seen and last-seen timestamps instead of creating duplicate rows. Findings can be filtered by severity, status, asset, CVE and CWE, then moved in bulk to resolved, false positive or risk accepted when the decision applies to a set.

Read about findings

Compliance mapping

CyberSpec maps open findings to SOC 2, ISO 27001 and PCI DSS control families from the weakness class behind each finding. The compliance view is not evidence collection or auditor workflow; it is a current technical-control view backed by live scan data.

Review compliance coverage

API keys and webhooks

API keys are scoped to an organization and can be revoked from settings. Alert targets support email, Slack and webhook delivery, with signed webhook payloads so receiving systems can verify that a finding notification came from CyberSpec before acting on it.

Review account security

Operational notes

Reports

PDF and CSV reports summarize scans, findings and remediation context. Reports are generated asynchronously so larger asset histories do not block the dashboard while the export is prepared.

Scheduled scans

Recurring scans use a cron-style schedule and avoid stacking multiple scans for the same asset at once. That keeps weekly or monthly monitoring useful without turning a slow full scan into a backlog.

Privacy controls

Account deletion, privacy export and retention sweeps are part of the product architecture. Waitlist data is separate from authenticated product data and is disclosed on the privacy page while launch mode is active.

Responsible disclosure

Security researchers can find the vulnerability-reporting contact at /.well-known/security.txt. That file is for reporting issues in CyberSpec itself; authorization to scan customer-owned assets is handled inside the product on each verified asset.