The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
Expert Mode Is Here: For When 'One Fixed Behavior for Every Scan' Isn't Enough
Built for the professionals who told us they wanted actual control, Expert Mode unlocks named, reusable Scan Profiles that tune the crawler, Active Testing, and AI Pentesting independently, and shows you exactly what effect each setting actually had.
1,706 Findings, 103 Groups: One Issue, One Card, Everywhere in Your Report
A missing header that's true of every page on your site used to show up as one finding card per page, ten cards for ten pages, eighty-three for eighty-three. Now it's one card, with every affected location listed underneath.
AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving
Every other layer in Decloak observes and flags things that look wrong. AI Pentesting is the one that actually attempts exploitation, inside a sandbox, with a fixed toolkit of five real, named tools, and only calls something confirmed once it's proven, not pattern-matched.
API Scanning Is Here: Decloak Now Finds and Tests Your REST, GraphQL, and SOAP Endpoints
Most of what a modern web app actually does happens through an API, and most API vulnerabilities never show up in a page-level scan. Decloak Enterprise now systematically discovers and lightly tests REST, GraphQL, and SOAP endpoints as part of Active Security Testing.
Scanning a Bare IP? We Now Check for Exposed Databases and Open Ports Too
When the scan target is a raw IP address rather than a domain, Decloak now passively checks around 18 commonly-abused ports, databases, remote access, file transfer, for anything open and reachable, plus a reverse DNS lookup. Connect-only, no probe data sent.
Subdomain Discovery Just Got a Lot More Complete, Thanks to Certificate Transparency
A wordlist can only ever find the subdomains someone thought to guess. Decloak now also queries certificate transparency logs, the public record of every hostname a certificate authority has ever issued an SSL cert for, so subdomains nobody guessed still get found.
Subdomain Takeover Detection Is Live: We Check Every CNAME for Abandoned Targets
A subdomain pointing at a third-party service you stopped using isn't just clutter, it's claimable. Decloak now checks every discovered subdomain's CNAME record for exactly that, live on every Starter+ scan, no extra step required.
1,000 Findings, 7 Things to Fix First: Introducing the Priority Remediation Plan
A full scan can surface hundreds of findings, useful for coverage, useless for a Monday-morning to-do list. The new Priority Remediation Plan collapses that into a ranked top-25, with the ranking logic shown, not hidden.
Meet the Decloak AI Assistant: It Already Knows Which Scan You're Looking At
A chat widget lives in the bottom-right corner of every page now. For free accounts it's a curated FAQ router. For paid plans it's a scan-aware agent that can pull your actual findings, look up a real CVE, and explain a compliance control, without you leaving the report.
Compliance Mapping Now Covers NIS2 and DORA, Not Just SOC 2 and ISO 27001
Every finding Decloak detects is now mapped to NIS2 and DORA controls alongside SOC 2 and ISO 27001. Same 36 finding categories, same underlying scan, two more frameworks to help you get ahead of this October's NIS2 deadline.
White-Label Reporting Is Here: Put Your Own Brand on Every Scan Report
Pro and above can now brand their Decloak PDF reports end to end: your logo, your accent color, your fonts, your footer. Built for agencies, consultants, and anyone using security scans as part of client work or lead generation.