A glimpse into the future of YADS Security Platform.
A dedicated PQC readiness report that analyzes all cryptographic assets across your infrastructure and assesses quantum-safe migration status. Generates a Cryptography Bill of Materials (CBOM) in CycloneDX format — aligned with NIS2, DORA, and BSI TR-02102 guidance.
| Feature | Description |
|---|---|
| PQC Readiness Report Available | Scans all certificates, TLS configurations, and cryptographic primitives. Classifies algorithms as quantum-safe, quantum-vulnerable, or transitional. Prioritized migration list with algorithm details (RSA, ECDSA, AES, etc.) and recommended PQC alternatives (ML-KEM / NIST FIPS 203, ML-DSA / FIPS 204, SLH-DSA / FIPS 205). |
| CBOM (CycloneDX) Export Available | Generates a Cryptography Bill of Materials in CycloneDX JSON format. Lists all cryptographic components with algorithm, key length, usage context, and quantum vulnerability rating. Required for NIS2/DORA supply chain security reporting. |
| Migration Risk Scoring Available | Each asset receives a quantum migration risk score (Low/Medium/High/Critical) based on algorithm strength, key length, certificate validity period, and exposure level. Executive summary with aggregate quantum readiness grade (A–F). |
| Multi-Port TLS Scan Available | PQC detection not limited to port 443 — covers all relevant TLS ports: HTTPS (:443/:8443), IMAPS (:993), SMTPS (:465/:587), and LDAPS (:636). Open ports are pre-checked with a 2-second TCP probe — closed ports are skipped immediately. |
| Certificate Signature Detection Available | Detects whether the certificate itself is signed with a PQC algorithm (ML-DSA-44/65/87, SLH-DSA variants, Falcon). Goes beyond KEX detection: the certificate must also be quantum-safe to achieve full PQC readiness. |
| PQC Trend Tracking Available | Historical fleet-wide PQC score progression and active PQC target count — aggregated daily, displayed as a dual-axis chart. Provides compliance evidence and management reporting on PQC migration progress. |
A complete AI-powered security analysis layer built directly into YADS. Uses your own OpenAI or Anthropic API key (BYOK model) with intelligent rule-based fallbacks when no AI key is configured. All outputs are available in English and German.
| Feature | Description |
|---|---|
| AI Finding Prioritization Available | Ranks all findings for a target by exploitability and business impact. Supports OpenAI (gpt-4o-mini) and Anthropic (claude-haiku-4-5) with per-tenant BYOK. Includes a rule-based fallback using severity scores and keyword boosting (RCE, SSRF, injection, XSS, etc.) when no AI key is configured. |
| AI Remediation Assistant Available | Generates step-by-step remediation guidance for any selected finding with effort estimation (low/medium/high) and reference URLs. Rule-based fallback covers 10+ vulnerability classes: CORS, XSS, SQL injection, SSL/TLS, HTTP headers, DNS zone transfer, cookie security, CSRF, RCE, and open redirect. |
| Natural Language Search Available | Query findings across all monitored assets in plain English or German. Examples: "critical nuclei findings on staging.example.com", "all high severity SSL issues", "email security problems this month". Live search with 500ms debounce, AI-parsed or regex-extracted filter chips (severity, module, domain). |
| AI Multilanguage Output Available | All AI endpoints accept a lang=de parameter. AI-generated rationale, remediation steps, and search interpretations are returned in German. Rule-based fallbacks are also fully translated, including effort labels and rationale strings. |
New high-level views for security management, C-level reporting, and cross-tenant visibility for platform administrators.
| Feature | Description |
|---|---|
| Executive Report (C-Level) Available | Non-technical security summary with: grade circle (A–F), numeric score (0–100), risk trend (improving/stable/deteriorating), KPI cards, segmented risk distribution bar, top 5 risk types, top 5 vulnerable assets, and prioritized recommended actions. Includes a print stylesheet for immediate PDF output. |
| Attack Path Visualizer Available | D3.js force-directed graph showing the attack surface of any scanned target. Nodes: host, open ports (risk-colored), services/technologies (with CVE counts), and findings. Directed edges model exploitation chains between high/critical findings. Zoom/pan, draggable layout, one-click attack-path navigation, and filter controls. |
| Multi-Domain Portfolio View Available | Platform-admin view with cross-tenant statistics: domain count, critical/high findings, average security score (A–F grade badge), plan tier, last scan. Expandable rows reveal top 3 vulnerable domains per tenant. Includes global KPI cards and "View as Tenant" impersonation link. |
| Multilanguage PDF & Excel Exports Available | All exports now accept ?lang=en or ?lang=de. German exports translate column headers, section titles, finding labels, and all fixed strings in both PDF and Excel formats. |
Tools to track the full remediation lifecycle of security findings and organize assets for better operational visibility.
| Feature | Description |
|---|---|
| Finding Status Tracking Available | Track the lifecycle of each finding with four states: Open, Acknowledged, False Positive, Fixed. Add analyst notes per finding. Status survives re-scans and is identified by a deterministic hash of domain|module|issue. Color-coded badges and a status filter on the Security Findings page. |
| Findings CSV Export Available | Export all findings to CSV with full filter support (severity, status, module, domain, date range). Columns: domain, title, severity, module, status, found_at, notes. |
| Asset Tagging & Grouping UI Available | Assign custom tags to targets (e.g. production, cloud, in-scope). Interactive tag cloud for filtering, inline tag editing per target, bulk tag operations (add/remove/replace across multiple targets), and central tag management with one-click delete across the tenant. |
| Extended Cloud Scanner Available | Added DigitalOcean Spaces (NYC3 + AMS3), Cloudflare R2. New Shadow IT detection across GitHub Pages, Netlify, Vercel, Heroku, Firebase Hosting, Render, Railway, and Fly.io — with false-positive filtering for default platform pages. Findings now include structured severity ratings compatible with AI analysis. |
Integrated 9 new specialized infrastructure and supply chain modules in v2.5.7.
| Module | Description |
|---|---|
| Brand Monitor Available | Deep OSINT module for monitoring brand mentions, domain typosquatting, and social media brand-jacking detection. |
| Compliance Frameworks Available | Cross-references findings against ISO 27001, NIST, and SOC 2 frameworks for automated compliance reporting. |
| JS Supply Chain Available | Detects vulnerable or malicious 3rd-party JS libraries and CDN drift via SRI (Subresource Integrity) validation. |
| CI/CD Exposure Available | Scans for exposed .gitlab-ci.yml, github/workflows, and Jenkins metadata files in public web roots. |
| Admin Panel Detection Available | High-precision detection of common admin interfaces (SAP, Kubernetes Dashboard, Jenkins, etc.) with banner fingerprinting. |
| Cloud Storage Deep Scan Available | In-depth analysis of web content for leaked S3, GCP, and Azure bucket identifiers and credentials. |
| Mobile App Monitor Available | Tracks the official mobile app footprint and detects unauthorized clones or unofficial versions in third-party markets. |
| Third-Party Risk Available | Evaluates the security posture of third-party vendors and external dependencies linked to your infrastructure. |
| Kubernetes Exposure Available | Checks for exposed K8s API server status, Kubelet info leaks, and insecure etcd configurations. |
| Email Security Available | SPF, DKIM, DMARC, and BIMI analysis. Checks email authentication configuration and scores the domain's email security posture (0–100). Detects spoofing-vulnerable configurations and missing DMARC enforcement policies. |
| HTTP Security Headers Available | OWASP-aligned analysis of all security response headers: Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy. Per-header scoring with remediation recommendations. |
| Cookie Security Analyzer Available | Checks all cookies for Secure, HttpOnly, and SameSite flags. Detects session cookie misconfigurations, overly broad domain scope, and missing attributes that could enable XSS or CSRF attacks. |
| CORS Misconfiguration Available | Tests 4 CORS origin patterns (null, wildcard, subdomain, arbitrary). Detects permissive cross-origin policies that expose APIs to unauthorized cross-site requests. |
| Certificate Domain Mismatch Available | Verifies TLS certificate subject/SAN fields match the actual domain. Detects mismatch, expired, or self-signed certificates that would trigger browser security warnings. |
| Threat Intelligence (AbuseIPDB/OTX/VT) Available | Enriches all discovered IPs with reputation data from AbuseIPDB, AlienVault OTX, and VirusTotal. Aggregate threat score, flagged-by count, and malware/phishing/botnet classification. Appears in analytics view and AI risk scoring. |
| Shodan & Censys Intelligence Available | Host intelligence from Shodan and Censys — open ports, banners, CVEs, and ASN data without active scanning. Provides passive reconnaissance data for all targets. |
| JS Secrets Scanner Available | Scans all JavaScript files loaded by the target for 25+ secret patterns: API keys (AWS, Google, Stripe, Twilio), JWTs, private keys, database credentials, and custom regex patterns. |
| Git Exposure Scanner Available | Probes 49 sensitive paths including /.git/, /.env, /config.yml, /backup.sql, and similar. Detects accidentally exposed source code repositories, configuration files, and backup archives. |
| Subdomain Takeover Detection Available | Checks CNAME chains against 30+ provider fingerprints (GitHub Pages, Netlify, Vercel, AWS S3, Heroku, Azure, Shopify, etc.). Identifies dangling DNS records that could be hijacked. |
| DNS Zone Transfer (AXFR) Available | Tests all authoritative nameservers for zone transfer vulnerabilities. Successful AXFR exposes the complete DNS zone — a high-impact information disclosure finding. |
| Security.txt Validator Available | RFC 9116 compliant security.txt discovery and validation. Checks for required fields (Contact, Expires), optional fields (Encryption, Policy), and correct file placement at /.well-known/security.txt. |
| Enhanced OSINT & Brand Intelligence Available | Improved brand monitoring with deeper web searches, lookalike domain detection (homoglyphs, bitsquatting, combosquatting), PhishTank/URLhaus integration, and reputation scoring across multiple data sources. |
A highly specialized detection module designed to identify defensive deception infrastructure. YADS analyzes target environments for honeypots, sinkholes, and tarpits to assess target legitimacy and prevent reconnaissance pitfalls.
| Capability | Description |
|---|---|
| Advanced Honeypot Detection Available | Multilevel detection of web (Glastopf, SNARE) and service honeypots (Cowrie, Dionaea, Mailoney). Utilizes banner fingerprinting, response timing, and behavioral analysis of "fake vulnerabilities". |
| DNS Sinkhole & Seized Domain Detection Available | Automatic cross-referencing against databases of known sinkhole infrastructures (Spamhaus, Microsoft DCU, Shadowserver). Detects domains seized by law enforcement agencies. |
| Tarpit & Timing Analysis Available | Identifies "tar pits" (HTTP/TCP tarpits) that bind scanners through artificial latency and "trickle data". Protects the scan queue from being blocked by intentional time-wasting defenses. |
| Confidence Scoring & Risk Assessment Available | Every detection receives a confidence score (0-100) and a risk rating (Low to Critical). Includes automatic blacklist recommendations for highly suspicious deception targets. |
The YADS Health Watcher is a proactive monitoring system that oversees the integrity of your scan cluster 24/7 and alerts immediately on anomalies.
| Watcher Function | Description |
|---|---|
| Proactive Alerting Available | Real-time alerting for worker failures (heartbeat), hanging tasks (>2h), queue congestion, or full disks. Notifications via webhook (system_alert) or directly within the admin interface. |
| Self-Healing & Optimization Available | Automatic detection of "orphaned tasks" and alert deduplication. Integrated "Redis Dedup" mechanism prevents alert fatigue caused by redundant notifications. |
| Infrastructure Integrity Checks Available | Continuous connectivity monitoring for Redis, PostgreSQL, and distributed Celery queues to prevent data loss and scan interruptions. |
| Feature | Description |
|---|---|
| Multi-language Platform (EN/DE) Available | Complete English and German interface. All UI elements, navigation, scan result labels, PDF reports, Excel exports, and AI-generated outputs are available in both languages. Language preference is user-configurable per profile and stored in a session cookie. Supported everywhere: web UI, PDF/Excel reports, AI assistant outputs, and analytics views. |
| Modular Scan Architecture & Profiles Available | All 19+ scanner modules are individually selectable per scan. Configurable scan profiles allow saving module combinations (e.g. "Quick Check", "Full Audit", "Compliance Scan") for reuse across targets. Per-target module selection persists across scheduled scans. |
| Module Report Center Available | Every scanner module now has a dedicated report page with configurable columns, PDF export, and Excel export. The central Reports page lists all available module reports with one-click access to View, PDF, and Excel for each module. |
| Proxy Support (Zscaler, etc.) | Configure HTTP/HTTPS proxy settings for all scanner modules (except Nmap). Essential for enterprise environments using security gateways like Zscaler, Netskope, or corporate proxies. |
| Custom TLS Certificates Available | Support for custom CA certificates and client certificates (mTLS) for scanning internal infrastructure behind corporate PKI. Includes HTTPS-only mode with environment variable override for emergency fallback. |
| One-Click Updates Available | In-app update mechanism that pulls the latest Docker image and performs a graceful restart without manual intervention. Includes automatic queue pause, task drain, and zero-downtime updates. |
| Enhanced Logging & SIEM Available | Structured logging with Splunk integration, unified log viewer with tenant filtering, real-time log streaming, and comprehensive audit trails for all scan activities. |
| Security Audit Logging (MITRE ATT&CK) Available | Comprehensive security event logging aligned with MITRE ATT&CK framework. Tracks login/logout events, password changes, MFA events, user management, role changes, and tenant switches. Includes IP address, user agent, and MITRE technique IDs for SIEM correlation. |
| Tenant-Aware Workers Available | Assign dedicated worker nodes to specific tenants with per-tenant resource quotas (concurrent scans, daily limits, network throughput). Full worker registration, heartbeat monitoring, and suspend/drain operations. |
| System Administration Dashboard Available | Central view of all workers with real-time metrics (CPU, RAM, Disk), cluster statistics (active workers, capacity, utilization), task queue depth, and worker management (suspend, resume, drain, remove). |
| Storage Analytics & Smart Cleanup Available | Intelligent disk usage monitoring for screenshots, logs, backups, and scan artifacts. Includes cleanup recommendations and one-click actions to prune orphaned files and compress old logs. |
| Prometheus/Grafana Export Available | Native metrics endpoint for infrastructure monitoring, alerting integration, and performance dashboards. |
| Software & Crypto BOM Available | CycloneDX-format Software Bill of Materials (SBOM) and Cryptography Bill of Materials (CBOM) for supply chain security, NIS2/DORA compliance, and post-quantum readiness assessment. |
Enterprise-grade authentication via Keycloak (OIDC). Organizations can use a bundled Keycloak instance managed by YADS, or connect to an existing corporate IdP. The setup wizard guides through all options with a full configuration summary.
| Feature | Description |
|---|---|
| Bundled Keycloak Available | YADS ships a pre-configured Keycloak container (Docker profile). The setup wizard generates all credentials, configures the realm and client automatically, and provides the admin URL and password in the final summary screen. |
| External Keycloak / OIDC Available | Connect YADS to any existing Keycloak instance or standards-compliant OIDC provider. Configurable realm, client ID, client secret, and redirect URI — all written to .env by the setup wizard. |
| Group-based Role Mapping Available | YADS roles (admin, tenant_admin, scanner, auditor) are mapped from Keycloak group claims. No manual user provisioning required after the initial migration script. |
| User Migration Script Available | One-command migration of existing local YADS users to Keycloak with dry-run mode, per-tenant filtering, and idempotent re-runs. Existing passwords are preserved via Keycloak's import mechanism. |
| Azure AD / Entra ID, SAML 2.0 Research | Direct Azure AD OAuth2 integration and SAML 2.0 SP support (Okta, Ping Identity, ADFS) are under evaluation for a future release. |
| Integration | Description |
|---|---|
| Webhook System Available | Configurable webhooks firing on scan_finished, finding_new, finding_resolved, score_drop, and target_archived events. Per-webhook severity filters and event selection. Signed payloads (HMAC-SHA256) for authentication. |
| Jira Available | Automatically create and close Jira issues based on scan findings. Configurable project key, severity mapping, and issue type. Status sync: when YADS marks a finding resolved, the Jira issue moves to Done. |
| GitHub Issues Available | New findings automatically open GitHub Issues with security labels. Supports github.com and GitHub Enterprise Server. Issues are automatically closed when findings are resolved. |
| Splunk / SIEM Available | All scan results and findings forwarded as structured JSON to Splunk HEC. Generic syslog forwarding available for other SIEM platforms. Configurable index and source type. |
| Slack / Microsoft Teams Available | Rich card notifications with score, finding count, and direct links. Configurable per event type and minimum severity threshold. |
| Scanner Import Available | Ingest results from Nmap XML, Nuclei JSONL, Burp Suite XML, OWASP ZAP JSON, and generic CSV. Normalises external findings into the YADS schema, generates change events, and includes them in scoring. |
| ServiceNow, Cortex XSOAR Research | ServiceNow ITSM and Cortex XSOAR bi-directional integration are under evaluation for a future enterprise release. |
18 additional scanner modules added in v1.42.0, all integrated into the Security Findings view, scoring engine, PDF/Excel exports, and EN/DE i18n.
| Module | Description |
|---|---|
| Open Redirect Detection Available | Detects URL parameters that redirect to arbitrary external domains. Score penalty up to −15. |
| TLS Deep Scan Available | Full cipher suite enumeration, protocol version support, HSTS enforcement, and TLS grade (A–F). Score penalty scales with grade: B=−5, F=−20. |
| Service Fingerprinting Available | TCP/UDP banner grabbing across 50+ common service ports for vendor and version identification. |
| ASN / IP Ranges Available | Autonomous System Number lookup, CIDR block mapping, hosting provider identification, and geolocation data. |
| Login & Auth Surface Available | Discovers login endpoints, authentication mechanisms, and exposed admin panels across the target. |
| IPv6 Attack Surface Available | Maps IPv6 addresses, open ports, and assesses WAF bypass potential via IPv6. |
| DNS History Available | Retrieves historical DNS records via passive DNS for IP pivoting and infrastructure history analysis. |
| Phishing Detection Available | Checks domain presence in Google Safe Browsing, PhishTank, and OpenPhish. Score penalty −20 if listed. |
| CT Log Monitor Available | Real-time Certificate Transparency log streaming to detect new certificate issuances for the domain. |
| Email Harvesting Available | Discovers email addresses exposed via web pages, document metadata, and OSINT sources. |
| Dependency Confusion Available | Checks whether internal package names (npm, PyPI, RubyGems) are resolvable via public registries. Score penalty up to −20. |
| GraphQL Security Available | Tests for introspection enabled, field suggestions, query batching abuse, and DoS vectors. |
| WebSocket Security Available | Checks ws:// vs wss:// usage, origin validation, and authentication enforcement on WebSocket upgrade. |
| Password Spray Surface Available | Maps enumerable authentication endpoints susceptible to credential stuffing and password spray attacks. |
| Leaked Credentials Available | Cross-references domain-related email addresses against public breach datasets (HIBP). Score penalty up to −25. |
| API Security Scanner Available | Tests for unauthenticated endpoints, excessive data exposure, and mass assignment vulnerabilities in REST APIs. |
| Mobile App Discovery Available | Discovers associated iOS and Android apps via app store lookups and deep link probing. |
| WAF Detector Available | Identifies WAF vendor via header, cookie, and response fingerprinting. Score: −5 if absent, +5 for high-confidence detection. |
| Feature | Description |
|---|---|
| Mobile Dashboard Available | Lightweight mobile-optimized interface for queue monitoring, scan control, and alert notifications on the go. Access at /mobile on your YADS instance. |
Native Kubernetes support for enterprise-grade horizontal scaling, high availability, and GitOps-driven deployments — without compromising YADS's multi-tenant isolation model.
| Feature | Description |
|---|---|
| Helm Chart Available | Official Helm chart for deploying the full YADS stack (API, Worker, PostgreSQL, Redis) to any Kubernetes cluster. Optimized for Cloud-Native deployments. |
| Horizontal Worker Autoscaling BETA | HPA-based autoscaling for YADS worker pods based on scan queue depth (using KEDA). Support for GKE and AKS worker pools. |
| Namespace Isolation per Tenant Planned | Optional per-tenant Kubernetes namespace isolation for regulated environments (DSGVO, SOC 2). |
| Ingress & TLS Automation Planned | Pre-configured Ingress manifests for nginx-ingress and Traefik, cert-manager integration for automatic Let's Encrypt certificates. |
| Persistent Volume Claims Planned | StorageClass-aware PVC templates for scan data, screenshots, logs, and encrypted backups. |
| GitOps / ArgoCD Integration Planned | Application manifest for ArgoCD/Flux — enables fully automated, diff-based rollouts from your Git repository. |
| Kubernetes Operator (future) Planned | CRD-based YADS Operator for declarative management of tenants, scan schedules, and worker fleets directly from kubectl. |
LLM-assisted analysis of the full target list to identify domains that don't belong to the tenant. Works provider-neutral with any configured LLM (OpenAI, Anthropic, Ollama, Azure OpenAI, custom). Always triggered manually — never automatic.
| Feature | Description |
|---|---|
| Primary Domain Wizard Planned | Define the tenant's core domains before analysis. YADS uses these as reference to evaluate relevance of all monitored targets. |
| LLM Relevance Analysis Planned | Batch analysis of all targets — each domain receives a verdict (related / unrelated / uncertain) with confidence score and a short AI-generated reason. Provider-neutral via YADS LLM abstraction layer. |
| Review & Bulk Actions Planned | Interactive review table with confidence threshold slider. Select unrelated domains for bulk deletion from target list or bulk-add to discovery blocklist. |
Automatically crawls and parses legal notice pages (Impressum, Imprint, Legal Notice) to extract structured company information. Validates §5 TMG completeness for German entities and generates compliance findings for missing mandatory fields.
| Feature | Description |
|---|---|
| Auto-Discovery Available | Probes ~15 candidate paths (/impressum, /imprint, /legal, /site-notice, …) and follows meta-link rel="impressum" hints from the homepage. |
| Structured Extraction Available | Extracts: company name, legal form (GmbH, AG, …), address, phone, email, Handelsregister (HRB/HRA), VAT ID (DE…), managing directors, data protection officer, EU dispute resolution link. |
| Completeness Scoring & Findings Available | Scores mandatory §5 TMG fields (0–100%). Generates SecurityFindings for missing fields, tenant name mismatch, and absent OS platform link. Category: Legal (violet badge). |
A system-defined, read-only scan profile containing exclusively passive OSINT and non-intrusive modules. Pre-configured for security teams that need to demonstrate legal compliance with German §202a/b StGB when scanning authorized targets.
| Feature | Description |
|---|---|
| Module Categorization Available | All YADS modules classified as: Legal (passive OSINT), Caution (active but non-exploiting), or Requires Authorization (nuclei, login probing). Visible in the module list with color-coded badges. |
| System Profile (Read-Only) Available | Pre-installed system scan profile with lock icon — not editable or deletable. Contains only the Legal-classified modules. Accompanied by a §202 StGB explainer with BMJ reference link. |
Scalability and reliability improvements for large-scale deployments with hundreds of monitored assets.
| Feature | Description |
|---|---|
| CT Log Redis Caching Planned | Certificate Transparency (crt.sh) queries are rate-limited and frequently timeout on large fleets. Results will be cached in Redis with a 24-hour TTL, eliminating redundant API calls on repeated scans of the same domain. |
| Adaptive Subdomain Wordlist Cap Planned | Replace the static 15k/50k wordlist size cap with a dynamic limit based on target response time and scan queue depth. Prevents slow targets from blocking the queue while maintaining thorough coverage on fast hosts. |
This area has been removed from scope. YADS remains a passive reconnaissance and monitoring tool — active offensive capabilities are not part of the product vision.
| Feature | Description |
|---|---|
| Metasploit Integration | RPC-based Metasploit control: launch modules, select payloads, view session output — scoped to authorized YADS targets. |
| Nmap Advanced Profiles | Extended Nmap scan profiles — SYN scan, OS fingerprinting, script engine (NSE) execution. |
| Hydra / Password Audit | Authorized credential brute-force audit against detected login surfaces. |
| SQLMap Integration | Trigger SQLMap against endpoints flagged by Nuclei or the crawler. |
| Burp Suite Collaboration | Push YADS target scope to Burp Suite Pro via REST API. |
| Authorization Enforcement | Per-target pentest authorization flag with RBAC (tenant_admin+). |
| Pentest Report Generation | Dedicated pentest report template exportable as PDF and DOCX. |