No agents, no code changes, no traffic re-routing. Origin works entirely from the outside — the same vantage point an attacker has, and the same one your customer’s reviewer cares about.
Add one DNS TXT record to prove ownership. From the apex, Origin enumerates subdomains and probes what’s live — building an asset inventory with first-seen and last-seen dates that updates itself on every scan.
Origin orchestrates respected open-source engines behind one calm findings model, with rate limits and exclusions you control. We don’t invent detection; we make it usable and provable.
TLS, DNS posture, headers and HTTP surface across every verified asset. Fast, safe, and the backbone of your evidence history.
ZAP-driven checks against the endpoints in your imported OpenAPI definition. Safe mode by default; active rules per approved scope.
Everything in baseline and api, plus the fuller nuclei template set. Slower, still rate-limited, scheduled when it suits you.
Findings move through a real workflow — and every step lands in the append-only audit log, so the story your evidence pack tells is complete.
Assign teammates, filter by severity or asset, share the exact view by URL. Viewers (your client contact, your assessor) see everything and can change nothing.
Some findings are known trade-offs. Accepting one requires a reason, records who decided, and keeps it visible in evidence rather than swept away.
Suppression also requires a reason and an author. It drops out of the default view, never out of the record — and you can reopen it any time.
The next scheduled scan confirms the fix; the finding's timeline shows open → assigned → resolved with dates. That's the line your reviewer wants to see.
Scope, checks performed, findings and their status, scan history — written so a non-specialist reviewer can follow it without a walkthrough.
An HMAC-SHA256-signed manifest covers every artefact in the bundle. Your reviewer verifies it offline — no Origin account, no trust in us required.
Each pack states exactly what was checked and what wasn’t. Automated external checks are not a penetration test, and your pack never pretends they are.
One DNS record. First findings within the hour.