Track your test coverage
You have seven catalogues ready to load, from WSTG to NIST SP 800-115.
They include the 267 ASVS requirements.
Each checked item links to the finding that provides its evidence.
For pentesters
From a documented test
to a reviewed report.
A test reveals an issue: what should the client receive?
Record the finding, steps and evidence, then prepare the report and its review.
After remediation, record the retest and its outcome. Automated analysis remains limited to supported scanners.
Request a demo
A 30-minute demo on a project close to yours.
From finding to deliverable
From finding to PDF, without copy-paste.
Four steps, one tool: a finding entered once feeds the report, the review and the delivered PDF.
Demo screenshots. Results illustrate this project, not every project.
Tamis interface · scanned WebGoat project
Under the hood
- Methodology
- Support your engagement with seven catalogues, from WSTG to NIST SP 800-115.
- Retest
- Rerun the supported scanner on the fixed asset to check whether the finding persists.
- Report
- Deliver your PDF report in French or English after approval by someone other than the person who submitted it.
- Targets
- Run DAST on your existing environments after providing proof of ownership.
- Deployment
- SaaS in the EU (OVHcloud or Scaleway) or self-hosted, air-gapped included
In Tamis
Keep track, from testing to reporting.
Build your attack chains
Your findings connect into a scenario mapped to the MITRE ATT&CK techniques they cover.
That scenario stays linked to the threat in the architect's model.
Retest and deliver the report
For findings from supported scanners, you can rerun the scanner on the fixed asset.
Before delivery, the report must be approved by someone other than the person who submitted it.
You can also export drafts in the client's branding.
On the same evidence
What moves between roles.
You receive
- Modeled threats and abuse scenarios to focus your tests.
- Findings AppSec has qualified as reachable or confirmed, with their trace.
- Verified fixes you can retest.
You pass on
- Your findings, gathered in the same queue as scanner findings.
- Retest results to flag whether a finding persists.
- Confirmed findings to feed the risk register.
Good to know Tamis gives you tools for the engagement.
Your expertise as a pentester remains essential.
DAST is limited to existing environments in the engagement scope, after ownership of their origin has been verified.
On the blog
Go further.
The mechanics explained simply, then in depth. All articles
