From Finding to Certainty
Recon scans produce findings that were true at scan time. Days or weeks later, the question becomes: is this still exploitable right now? Traditional workflows require a manual re-scan of the entire module — slow, resource-intensive, and imprecise.
Active Validation is a targeted single-finding check. It runs a lightweight, purpose-built probe exactly against the affected domain and confirms the vulnerability's current state in real-time — without triggering a full scan cycle.
How Active Validation Works
Open a Finding
Navigate to any Security Finding with an applicable validator. The Active Validation panel appears in the left sidebar alongside Verification and Workflow State.
Click "Validate Now"
YADS calls the matching built-in validator synchronously. The validator runs a targeted probe against the live domain — typically completing in 2–10 seconds.
Read the Verdict
The result is persisted to the finding (validation_status, validation_evidence, validated_by) and shown immediately in the UI — no page reload required.
Act on the Evidence
Use the verdict to prioritise remediation, de-prioritise false positives, or demonstrate to auditors that a control is effective. The evidence string and raw JSON are both retained.
15 Validators. Zero Configuration.
Every validator ships with YADS and requires no setup. They are automatically matched to findings based on module and issue type. With the latest update, the suite has been expanded to 15 specialised validators.
JWT "none" Algorithm
jwt_none_bypass
Crafts a JWT with alg=none and an unsigned payload. Confirms whether the target accepts unsigned tokens — a critical authentication bypass.
OpenAPI Spec Exposure
openapi_exposureValidates discovered Swagger/OpenAPI documents for syntactic correctness and reachability. Prevents false positives from generic 404/200 WAF responses.
Exposed Admin Interface
admin_exposure_recheckProbes admin paths for HTTP 200, validates login keywords, and excludes catch-all redirects to the homepage. Only genuine login masks are confirmed.
Dependency Confusion
dependency_confusionChecks internal package names against public registries (NPM, PyPI). Confirms hijacking potential if the name is still available publicly.
Cookie Security Suite
cookie_samesite, secure, ...
Three validators for HttpOnly, Secure, and SameSite flags. Confirms session hardening via real-time header analysis.
M365 User Enumeration
m365_user_enumerationChecks Microsoft 365 endpoints for user existence leakages. Validates whether email addresses can be used for password spraying attacks.
Managed via the Extension Hub
All built-in validators are listed in the Extension Hub under Active Validators — alongside installed add-on modules and scanner extensions. Platform admins get a single pane of glass showing every component that YADS can execute on behalf of a tenant.
- → Validator ID, label and scan module mapping visible at a glance
- → Mode indicator: Passive (read-only DNS / HTTP re-fetch) vs Active (live exploit attempt)
- → Future validator add-ons will appear in the same section
Platform Admin Controlled
Active Validation is opt-in per tenant. A platform admin must explicitly enable it in Tenant Settings → Security. Tenant admins can see whether it is enabled but cannot toggle it themselves.
This two-level gate ensures that validators — especially those performing active probes — are only run by organisations that have explicitly accepted the associated risk and have the appropriate authorisation in place.
⚠ Legal notice — active probes
Active validators (mode: Active) send exploit-like requests to live systems. Ensure you have written authorisation from the asset owner before use. In Germany and the EU, unauthorised security testing may constitute a criminal offence under § 202a StGB (unauthorised access to data) or § 202c StGB (preparation of unauthorised access). Passive validators (DNS queries, read-only HTTP re-fetches) are generally risk-free but must still comply with applicable data protection regulations (GDPR Art. 5, 32).
Regulatory Relevance
Active Validation helps close the gap between a one-time scan and the continuous evidence required by modern security frameworks and legislation. Use validation evidence as documented proof that a control was tested and the result recorded.
NIS2 Directive
NIS2 (EU 2022/2555, national transpositions in force from Oct 2024) mandates "appropriate and proportionate technical measures" and incident handling capabilities. Validation evidence contributes to the required continuous monitoring record under Art. 21.
DORA (Financial Sector)
DORA (EU 2022/2554, applicable from Jan 2025) requires financial entities to conduct Threat-Led Penetration Testing (TLPT) and maintain ICT risk management documentation. Validation results serve as lightweight re-test evidence between full TLPT cycles.
ISO 27001 / BSI IT-Grundschutz
ISO 27001:2022 Annex A 8.8 (management of technical vulnerabilities) requires tracking and verifying vulnerability remediation. Validator results, including timestamp and validated_by, provide directly auditable evidence for ISMS documentation.
GDPR — Data Exposure Findings
For findings involving personal data exposure (js_secrets, api_security_scanner), validation determines whether a reportable breach condition exists right now. A confirmed result may trigger GDPR Art. 33 notification obligations (72-hour window). A not-confirmed result documents timely remediation.
Complete Validator Reference
Active Validation is included, free
Every YADS installation includes Active Validation — no license key, no add-on purchase. Install YADS and try it against your own infrastructure.