Question 1

Does my data stay in my infrastructure?

Accepted Answer

Yes — on every paid plan (Pilot, Essential, Professional, Enterprise), Vex Raptor is self-hosted via Docker Compose on your own servers. Your scan data, findings, and API keys never leave your perimeter. The free Eval tier runs on Vex's hosted console (app.vexraptor.com) for a one-time evaluation only — it is not a cloud pentest product.

Question 2

Is it legal? Can I scan any target?

Accepted Answer

Vex Raptor is built exclusively for authorized pentesting. A target authorization gate is enforced at the API level — you must confirm ownership or explicit authorization before a scan launches. Scanning systems you do not own or have written permission to test is illegal regardless of the tool used. Raptor is not a "point and shoot" scanner; it is a platform for professional security practitioners.

Question 3

Can I use Raptor for compliance reporting (SOC 2, PCI-DSS)?

Accepted Answer

Raptor maps every finding to relevant SOC 2 Trust Services Criteria, PCI-DSS controls, ISO 27001 Annex A, and GDPR Articles — for audit prep and gap analysis. The compliance report groups findings by framework and lists affected controls. It does not produce a PASS/FAIL certification verdict. Vex Raptor is not SOC 2 (or other framework) certified; mapping is not certification. Compliance mapping is included on all paid plans.

Question 4

What does CONFIRMED mean?

Accepted Answer

A finding reaches CONFIRMED with at least one DIRECT signal, or a DIFFERENTIAL signal that passed a negative control — not a single reflection or scanner alert. HIGH is the tier that requires two independent CORRELATIVE signals.

Question 5

What's included in Eval?

Accepted Answer

Eval is free: one target, one full-depth scan on the hosted console (app.vexraptor.com) — not self-hosted. You get the full pentest stream, all attack phases, HTML + JSON reports, and community support. No seed pack, no commitment.

Question 6

Do I need a security team to use Vex Raptor?

Accepted Answer

No. Many customers are CFOs, general managers, or IT leads who authorize scans and share reports with an external provider. Vex runs autonomously on your authorized targets and produces documented evidence — you do not need in-house pentesters. Technical depth (CVSS, MITRE ATT&CK, reproducible PoC) is in every report when your IT partner or auditor needs it.

Question 7

How long does implementation take?

Accepted Answer

On paid plans, a single docker compose up starts the full stack on your infrastructure — typically the same day your license is provisioned. Eval requires no installation: sign in at the hosted console and run one evaluation scan immediately. Pilot includes a live report walkthrough with the Vex team to help you interpret the first results.

Question 8

How does the cost compare to a one-off external audit?

Accepted Answer

A point-in-time manual pentest typically costs €4,000–7,000+ per engagement and expires the day it is delivered. Vex Raptor Pilot is €3,500 ($3,800) flat for 90 days with up to 5 targets, and Essential is €7,200 ($7,800) per year for continuous on-demand scans on up to 3 targets — self-hosted, with compliance mapping included. You get depth you can re-run whenever your surface changes, not a single snapshot.

Technical writeups

How Vex Raptor decides what's CONFIRMED