Question 1

Does my data stay in my infrastructure?

Accepted Answer

Yes — on every paid plan (Pilot, Essential, Professional, Enterprise), Vex Raptor is self-hosted via Docker Compose on your own servers. Your scan data, findings, and API keys never leave your perimeter. The free Eval tier runs on Vex's hosted console (app.vexraptor.com) for a one-time evaluation only — it is not a cloud pentest product.

Question 2

Is it legal? Can I scan any target?

Accepted Answer

Vex Raptor is built exclusively for authorized pentesting. A target authorization gate is enforced at the API level — you must confirm ownership or explicit authorization before a scan launches. Scanning systems you do not own or have written permission to test is illegal regardless of the tool used. Raptor is not a "point and shoot" scanner; it is a platform for professional security practitioners.

Question 3

Can I use Raptor for compliance reporting (SOC 2, PCI-DSS)?

Accepted Answer

Raptor maps every finding to relevant SOC 2 Trust Services Criteria, PCI-DSS controls, ISO 27001 Annex A, and GDPR Articles — for audit prep and gap analysis. The compliance report groups findings by framework and lists affected controls. It does not produce a PASS/FAIL certification verdict. Vex Raptor is not SOC 2 (or other framework) certified; mapping is not certification. Compliance mapping is included on all paid plans.

Question 4

What does CONFIRMED mean?

Accepted Answer

A finding reaches CONFIRMED with at least one DIRECT signal, or a DIFFERENTIAL signal that passed a negative control — not a single reflection or scanner alert. HIGH is the tier that requires two independent CORRELATIVE signals.

Question 5

What's included in Eval?

Accepted Answer

Eval is free: one target, one full-depth scan on the hosted console (app.vexraptor.com) — not self-hosted. You get the full pentest stream, all attack phases, HTML + JSON reports, and community support. No seed pack, no commitment.

Question 6

Do I need a security team to use Vex Raptor?

Accepted Answer

No. Many customers are CFOs, general managers, or IT leads who authorize scans and share reports with an external provider. Vex runs autonomously on your authorized targets and produces documented evidence — you do not need in-house pentesters. Technical depth (CVSS, MITRE ATT&CK, reproducible PoC) is in every report when your IT partner or auditor needs it.

Question 7

How long does implementation take?

Accepted Answer

On paid plans, a single docker compose up starts the full stack on your infrastructure — typically the same day your license is provisioned. Eval requires no installation: sign in at the hosted console and run one evaluation scan immediately. Pilot includes a live report walkthrough with the Vex team to help you interpret the first results.

Question 8

How does the cost compare to a one-off external audit?

Accepted Answer

A point-in-time manual pentest typically costs €4,000–7,000+ per engagement and expires the day it is delivered. Vex Raptor Pilot is €3,500 ($3,800) flat for 90 days with up to 5 targets, and Essential is €7,200 ($7,800) per year for continuous on-demand scans on up to 3 targets — self-hosted, with compliance mapping included. You get depth you can re-run whenever your surface changes, not a single snapshot.

Case	Phase	Result	Notes
recall_cmdi_ping	cmdi	PASS	shell via host= (audit deep test)
recall_xss_search	xss_waf	PASS	unescaped HTML reflection — WAF bypass phase
recall_ssti_greet	ssti	PASS	template eval {{7777*7777}}
precision_safe_cmdi	cmdi	PASS	html.escape — must not CONFIRM CmdI
precision_safe_xss_waf	xss_waf	PASS	html.escape — ENGINE-18 / audit H1

Lab	Result	Hits	Notes
Broken Crystals	PASS	1/1	GraphQL introspection / misconfig — SPA demo target
OWASP Juice Shop	SKIPPED	0/1	REST search XSS recall on public demo instance
VAmPI (local)	PASS	1/1	BOLA on /users/v1/{username} — docker compose in demo/

Honest lab metrics — with caveats

BENCH-01 — in-process regression fixture (3 recall + 2 precision cases)

Novel targets (GEN-01b) — clean motor, no lab seeds

Multi-lab probes (BENCH-02)