# Cybersecurity services

Run security work as a loop: authorized testing, evidence-backed findings, owner queues and retests that actually close.

## Findings that turn into fixes

Boni runs security work as a loop, not a scan. Agents collect the signals, turn noisy scanner output into comparable findings, cluster and draft, then route each one to whoever has to fix it — with a retest date attached. A person owns the judgment calls.

The reason to care about the difference: a scan produces a PDF nobody actions. A loop produces closed findings with proof.

## In this section

| Page | What it covers |
|---|---|
| [Web and API audits](/security/web-app-audits) | What an audit covers, and what has to be agreed before it starts |
| [Vulnerability management](/security/vulnerability-management) | The ongoing loop: collect, normalize, triage, remediate, retest |
| [Audit readiness](/security/audit-readiness) | Getting reports, evidence and process documentation ready for real review |

## How the loop runs

| Stage | What happens |
|---|---|
| Scope | You and Boni agree a written target list, limits and timing |
| Collect | Public exposure signals and authorized scan output, gathered against that list |
| Normalize | Scanner records become comparable findings with asset, severity, evidence, owner and status |
| Triage | Related findings are clustered and summarized, false-positive patterns flagged, owners suggested |
| Remediate | Validated issues go to owner queues with fix guidance and a retest date |
| Close | Retest evidence attaches to the finding, and the report reflects it |

Recurring review gets cheaper because assets, patterns, accepted risks and past false positives stay in the same records. The second audit does not start from zero.

## Where a person decides, not the AI

AI compresses and routes the work. Four decisions stay human:

| Decision | Why it is not automated |
|---|---|
| Scope | What may be tested is a commercial and legal boundary |
| Severity | Risk depends on your business, not on a scanner's default rating |
| Validation | Whether a suspected issue is genuinely exploitable |
| Disclosure | What is said, to whom, and when |

## What Boni will not do

- Test anything outside the written target list. A surface not on the list is not touched.
- Run destructive actions or access private data. Both are excluded explicitly.
- Show you a summary without its evidence. Every finding links back to a URL, asset, timestamp, scanner record, screenshot or note.
- Collapse confidence states. A public observation, a suspected issue, a validated vulnerability, an accepted risk and a fixed finding stay distinct.

## Getting started

Scope an audit with Boni. The first conversation defines the target list, the exclusions, the timing and who receives findings. Commercial terms are agreed per engagement.

Canonical: https://docs.boni.one/security/overview
Version: 1
Updated: 2026-08-19T10:30:04.697Z