Platform
Everything that changed, and what your team decided.
Vikax monitors your web applications from the outside and groups each change into a release. It compares each release with your last assessment and keeps your team's decisions with the evidence.
demo-bank / customer portal / assessments
Web application assessment, March 2026sealed
Assessment record
sealed 14 Mar 2026, 09:12 UTCIn scope
what the assessment covered and how production compares now| Page or file | Checked as | Last checked | Since assessment |
|---|---|---|---|
| / | HTML page | 4 min ago | matches |
| /login | Headers | 4 min ago | changed |
| /checkout | HTML page | 4 min ago | changed |
| /checkout | Script | 4 min ago | matches |
| /account | Headers | 4 min ago | changed |
| /api/v1/openapi.json | JSON | 1 h ago | matches |
| /terms.pdf | PDF text | 1 h ago | matches |
| /static/app.3f9c.js | Script | 1 h ago | matches |
Excluded
2, each with a reasonNever stored in the record
- Response bodies.
- Secret headers and credentials.
- Anything from inside the application.
Seal
How it works
From a release in production to a decision on testing.
Vikax keeps a fixed record of what your last assessment covered and watches production for change. The decision on what to test stays with your analysts.
- 01
Record what was tested
When an assessment ends, Vikax seals a record of what it covered. The record lists the application and the pages in scope, with a tamper-evident reference to the evidence captured that day. Nobody can edit or delete it.
One sealed record for each completed assessment
- 02
Monitor production
Checks run from the outside on the schedule you set, from every five minutes to once a week, with quiet hours when you need them.
Pages, scripts, headers, APIs and PDF documents
- 03
Group changes into releases
Vikax groups related changes into a release for each environment. Your team confirms planned releases, names them after its change reference and dismisses wrong groupings with a reason.
Every action is recorded with who, when and why
- 04
Decide what needs testing
Vikax shows how far the application has moved since the last assessment and which areas a tester should look at. An analyst records whether the change needs testing.
Keep monitoring · Review first · Targeted testing · Full assessment · No testing needed
- 05
Keep the evidence
Vikax keeps the evidence behind every assessment record. Each export records who produced it, and audit logs are kept for at least 400 days.
PDF · HTML · JSON · ZIP
Monitoring
See production as anyone on the internet can reach it.
Vikax checks what anyone on the internet can reach, and ignores routine noise when it compares.
Checks from the outside
Vikax reads pages, scripts, headers, API responses and PDF documents the way any visitor can request them. It only reads. It never submits forms or reaches private networks.
Watch the parts that matter
Vikax compares a page as text, HTML or JSON, scripts and headers as they are served, and PDFs by their text. Point a monitor at one part of a page with a CSS or XPath selector.
Know what kind of change it was
Vikax names the change, such as a new third-party script, a widened content security policy or a new API route. These are pointers for your analysts and never count as findings.
- New third-party domain
- Security header removed
- Content security policy widened
- API route added
- Form destination changed
- Login flow changed
- JSON structure changed
- +8 more
Ignore what does not matter
Timestamps, session IDs and tracking parameters change on every visit. Noise rules tell Vikax to ignore them when it compares, for one monitor or the whole workspace. The stored evidence stays exactly as observed.
- Dates and times
- Session and request IDs
- Tracking parameters
- Chosen headers
- Parts of a page
- Small changes below a threshold
Read-only, and kept off your internal network
Checks use only ports 80 and 443 and cannot reach private or cloud metadata addresses. Each response stops at 25 MiB or 30 seconds, and monitored content never runs in your analysts' browsers.
Releases and review
Open a change and see its whole record.
Every change arrives with what changed, the release it belongs to and how far it moves the application from its last assessment. Your analysts assign it, discuss it and decide.
How far each application has moved
Six states, from stable to a major change in what was tested. A state describes change. It is never a security score.
- StableProduction still matches what was tested.
- Minor changeChanges outside the areas that were tested.
- Significant changeChanges in areas the assessment covered.
- Major changeThe tested areas have changed substantially.
- Coverage incompleteSome pages could not be checked.
- Not compared yetVikax has not compared it yet.
Five decisions and a permanent history
Nobody edits a decision. Your team records a new one or an outcome, and the history stays.
- Keep monitoringNothing to test yet.
- Review firstAn analyst reads the change before deciding.
- Targeted testingTest the areas the change touches.
- Full assessmentThe last assessment no longer describes the application.
- No testing neededA known, expected change.
- Planned
- Completed
- No security impact found
- Security issue identified
- Configuration regression found
- Known, expected change
- Inconclusive
Evidence
Evidence that holds up after the release.
Every comparison keeps the page it was made from. By the time your analyst records a decision, Vikax has already kept the evidence behind it.
Evidence stays with the record
The pages and responses behind an assessment record are kept. Retention clean-up never removes them.
Exports for auditors and clients
Export an assessment record, a release or a date range as PDF, HTML, JSON or ZIP. Each export is recorded with a fingerprint of its contents, so anyone holding the file can check it has not been altered.
An audit trail nobody can edit
Every export and decision is written to an audit log that cannot be edited and is kept for at least 400 days.
Your records outlast a licence
If a licence lapses, new checks stop. Your team can still read everything Vikax recorded.
demo-bank / evidence
Evidence exports4 jobs this week
New export
evidence package- ✓JSON
- ✓HTML
- ✓ZIP
Export jobs
newest first| Job | Scope | Formats | Size | Status | By |
|---|---|---|---|---|---|
| EXP-1187 | Customer portal · since the March assessment | JSON · HTML · PDF · ZIP | 19.7 MB | completed | A. Hassan · 09 Oct, 08:22 |
| EXP-1186 | Open banking API · September releases | CSV · JSON | 0.8 MB | completed | M. Khalil · 07 Oct, 15:03 |
| EXP-1185 | Claims intake · assessment record | 1.1 MB | completed | A. Hassan · 02 Oct, 10:48 | |
| EXP-1188 | Customer portal (staging) · raw evidence | ZIP | preparing | running | A. Hassan · 09 Oct, 09:40 |
EXP-1187
package contentsAudit
this job- 08:21 UTCExport requested · Lead analyst
- 08:21 UTCPackage created · 4 formats
- 08:22 UTCExport completed · fingerprint recorded
Integrations
Alerts in the tools your teams already use.
Slack, Microsoft Teams, Discord, email and signed webhooks, for each change or as a scheduled digest. Integrations are included in every plan. The REST API comes with the Professional and Enterprise plans.
Questions
Common questions
Book a demo
Follow one change from release to decision.
The team that built Vikax walks you through monitoring, release review and testing decisions on sample data.