Know what changed in production, and whether it was planned.
Vikax is change assurance for production web applications. It monitors each application from the outside, groups every change into a release and records your team's decision on testing.
The console
Every application, release and decision in one place.
See which applications have changed since their last assessment and which testing decisions are still open.
demo-bank / all applications
Overviewall checks reachable · last 4 min ago
Applications
12 applications · most open changes first| Application | Last assessment | Since assessment | Open | Latest release | Decision |
|---|---|---|---|---|---|
| customer-portal.demo-bank.testRetail banking | 14 Mar | Significant change | 3 | not confirmed2 h ago | Targeted testing |
| staging.demo-bank.teststagingRetail banking | 14 Mar | Major change | 2 | not confirmed16 d ago | Full assessment |
| api.demo-bank.testOpen banking | 02 Mar | Minor change | 1 | CR-10477yesterday | Review first |
| payments.demo-bank.testPayments | 20 Jun | Minor change | 1 | not confirmed4 d ago | Review first |
| cards.demo-bank.testCards | 28 Feb | Coverage incomplete | 0 | CR-104703 d ago | Keep monitoring |
| auth.demo-bank.testIdentity | 14 Mar | Stable | 0 | CR-104668 d ago | · |
| business.demo-bank.testCorporate banking | 18 Aug | Stable | 0 | CR-1045212 d ago | · |
Change over 30 days
changes seen and closed by a decision- Changes seen
- Closed by a decision
- State changed
Since last assessment
applications- Stable7
- Minor change2
- Significant change1
- Major change1
- Coverage incomplete1
Kinds of change this week
pointers for review- Content security policy widened4
- New third-party domain3
- API route added2
- Security header removed1
- Form destination changed1
Open testing decisions
where to test, by change- Applications at a glanceEach application shows how far it has moved since its last assessment, and whether its latest release was confirmed.
- Change this weekNew third-party scripts, widened security policies and new API routes, counted across your applications.
- Open decisionsPlanned testing, reviews in progress, and the person who owns each one.
How it works
Your last penetration test describes one version. Production has moved on since.
After every test, the application keeps changing: planned releases, configuration, CDN and firewall rules, and third-party scripts. Some of those changes never go through your release process.
01 · Monitor
Watch production from the outside.
Vikax checks the pages, scripts, headers, APIs and documents you choose, on a schedule from every five minutes to once a week. It filters out routine noise such as timestamps and session IDs before it compares, and the stored evidence is never altered.
How monitoring works02 · Releases
Account for every release.
Vikax groups related changes into a release for each environment. Your team confirms the releases it planned, names them after its own change reference and follows up on the changes nobody expected.
How release review works03 · Decide
Decide what needs testing.
Vikax compares each release with the record of your last assessment and shows which tested areas it touched. An analyst decides whether the change needs testing, and the decision stays with its evidence.
How testing decisions workUse cases
One record of change, many questions answered.
Security, delivery and audit teams ask different questions about the same production changes. Vikax answers them from one record.
What changed since our last penetration test?
Pick a date, such as the end of your last test, and see every change since, by release and by application.
Was this change part of a planned release?
Releases your team confirmed carry its change reference. Anything outside them stays open until someone reviews it.
Did a third-party script or security header change?
Vikax names the kind of change, such as a new script source, a removed security header or a new API route.
Which applications need testing this quarter?
Each application shows how far it has moved since its last assessment and which testing decisions are open.
Can we show an auditor what happened?
Export the record of any change or period as PDF, HTML or JSON. Records cannot be edited or deleted.
Can our testing provider follow our applications?
Providers see your applications only with access you approve, limit to named analysts and can revoke.
Evidence
A record your auditors can verify.
Every change keeps its before and after, the release it belongs to, the assessment it is measured against and the decision your team made. Records cannot be edited or deleted afterwards.
Who it is for
Built for the teams that answer for production.
Vikax gives security, testing and delivery teams the same record of what changed, so they can agree on what happens next.
- Security and assurance teamsKnow when an application has moved away from what was tested. Decide what to test next from the recorded evidence.Vikax for security teams
- Testing firms and managed providersSee what changed in each client's production since you delivered the report, and show the client the evidence.Vikax for partners
- Delivery and change ownersSee each release as production received it, under your own change reference. Settle open questions with security before the next release.How release review works
Integrations
Alerts in the tools your teams already use.
Send changes to Slack, Microsoft Teams, Discord, email or your own systems through signed webhooks. Choose an alert for each change or a scheduled digest.
Book a demo
See how Vikax answers what changed since the test.
A guided walkthrough of monitoring, release review and testing decisions, with the team that built Vikax.