The same applications and networks come back every cycle, but last quarter's context lives in someone's folder, and fixed means a ticket was closed. Neuron keeps the testing, the hand-off and the retest in one record, inside your perimeter.
A recurring internal assessment from planning to signed-off retest, using features that ship in Neuron today.
Plan engagements, assessments, phases and retests on the Gantt schedule. Assign testers by dragging work onto them, and resolve double bookings before kickoff.
Pull in Nessus, Qualys or Nexpose results, plus Prowler and ScoutSuite for cloud. Every issue lands in a triage queue where it can be assigned, grouped by service, dismissed or promoted to a finding.
Run a playbook such as NIST SP 800-115 or the OWASP API Security Top 10. Coverage comes from the state of each step, and a step marked not applicable needs a reason.
When a finding is approved, a routing rule pushes it to ServiceNow with its evidence images. Pushes queue in the background and retry if ServiceNow does not respond.
Open a retest round against the original findings. Each one gets a recorded outcome: resolved, partially resolved, not resolved, risk accepted, or no retest performed.
Verdicts can require a second person to co-sign. Once the round is ready for approval, its results are locked, and the round keeps its own approver, timeline and audit trail.
Timings are examples.
A finding closes on a recorded retest outcome, not because a ticket changed state. Each retest round has its own approver, timeline and audit trail.
Sign-off is a deliberate attestation step, designed with PCI DSS v4.0 requirement 11.4.4 in mind. You choose whether critical, critical and high, or all verdicts need a second person.
Scan issues move through New, In Review, Confirmed, Promoted, False Positive, Risk Accepted and Fixed.
Routing rules push approved findings to ServiceNow based on a condition tree over finding and engagement fields, using your own severity names. Connections authenticate with OAuth2 client credentials, Basic or Bearer.
Every push is queued, retried on failure and recorded in a push history you can export. ServiceNow is the only ticketing connector today. Anything else connects through the REST API, which has OpenAPI documentation and tokens that can be limited to specific engagements.
Single sign-on with OIDC (with PKCE) or SAML 2.0, working with Okta, Microsoft Entra ID, Google Workspace, ADFS and Ping. Accounts are never auto-provisioned: an administrator creates each one before its first sign-in.
The assessment catalogue has 22 templates across applications, infrastructure, adversary simulation and devices. Cloud, Containers and Identity & Access Management map to CIS Benchmarks and MITRE ATT&CK. AI / LLM Application Testing maps to the OWASP Top 10 for LLM Applications and MITRE ATLAS, and records the prompt transcript.
Neuron triages scanner output for the test in hand. It does not replace the system that tracks every vulnerability across the estate.
Remediation work lives in ServiceNow or your own tooling. Neuron hands findings over and records the retest.
ServiceNow is the only ticketing connector that ships today. Other systems connect through the REST API.
ServiceNow, through the Workflow Integrations module, with routing rules that push approved findings automatically. Other systems connect through the REST API.
Each retest round records an outcome per finding, who signed it off and when, and an optional co-signature. The round has its own audit trail and its results lock once it is ready for approval.
Yes. OIDC and SAML 2.0 work with Okta, Microsoft Entra ID, Google Workspace, ADFS, Ping and other standard identity providers.
Yes. The assessment catalogue includes Cloud, Containers, Identity & Access Management and AI / LLM Application Testing, each with its own fields and methodology mapping, and Prowler and ScoutSuite results import into the triage queue.
Staff have one of five roles, and people are added to each engagement's team. API tokens can be limited to specific engagements, and the Delivery Portal has its own client roles if results go to business units.
No. Neuron runs on infrastructure you control, and we never receive your findings, evidence or credentials.
No. Neuron AI is a separate, optional module. When you use it, the models run on your hardware and no prompt is sent to a third-party provider.
We will walk your team through a cycle in Neuron, from scanner import to a signed-off retest, behind your own identity provider.