Security resources
Reference material we maintain for security engineers — starting with a live, cross-checked CVE database.
- Vulnerability Database
1,694 actively-exploited CVEs tracked against CISA KEV, FIRST EPSS, NVD, and the GitHub Advisory Database.
- Glossary
35 application-security and offensive-security terms, defined and cross-linked.
- CWE Database
969 Common Weakness Enumeration entries from the official MITRE catalog.
- HTTP Status Codes
All 36 HTTP status codes, with the security relevance of each.
- HTTP Headers
12 HTTP security headers — what each does and how to configure it.
- Security by Language
Application-layer security risks for 8 languages and frameworks.
- Security Knowledge Graph
16 vulnerability classes, mapped to CWE, CAPEC, MITRE ATT&CK, and OWASP.
- Guides & Checklists
8 practical how-tos, checklists, and standards explained.
- Compare
Impactr vs 8 named tools, plus methodology comparisons.
- Security by Industry
Industry-specific risk guidance across 8 industries.
- Capabilities
What Impactr investigates, chains, and proves — in depth.
By use case
- AI penetration testing
AI penetration testing replaces the pattern-matching of a traditional scanner with software that investigates an application the way a person would - forming hypotheses, following leads, and chaining individually minor findings into a proven attack path. Impactr is built this way: a coordinator plans what's worth testing, and specialized AI agents investigate, exploit, and validate in parallel.
- Autonomous penetration testing
Autonomous penetration testing performs the work of a penetration tester - mapping the attack surface, investigating leads, chaining findings, and proving impact - without a human operator directing each step. That autonomy is what lets it run continuously, on every deploy, rather than as a scheduled engagement a few times a year.
- Web application penetration testing
Web application penetration testing investigates a running application for the flaws that actually lead to compromise: broken access control, injection, and the business-logic issues that automated scanners consistently miss. Impactr runs this style of investigation continuously, testing across authenticated roles the way an attacker who has an account would.
- API penetration testing
APIs fail differently from traditional web apps. The highest-impact issues are almost always authorization and business-logic flaws - not the injection bugs a scanner is tuned to find. Impactr tests REST and GraphQL APIs, with or without an OpenAPI spec, reasoning about object ownership and role boundaries across every endpoint.
- Continuous penetration testing
Continuous penetration testing runs on every deploy or on a rolling basis, instead of as a periodic, scheduled engagement. Impactr is built to deliver exactly this: the depth of investigation a pentest provides, at the cadence your team actually ships at.