What is a vulnerability scan and why do I need one?

A vulnerability scan systematically examines your web applications, APIs, servers and network for known security weaknesses, misconfigurations, outdated components, missing patches, exposed services, weak authentication. Regular scans are required by ISO 27001 (A.12.6), SOC 2 (CC7.1), PCI DSS 11.2, and, for regulated Indian entities. RBI Cybersecurity Framework.

How often should I scan?

ISO 27001 recommends after any significant change and at least quarterly. RBI Cybersecurity Framework requires VAPT for NBFCs at least twice a year. CERT-In requires an annual VAPT for critical information infrastructure. dcomply schedules and stores every scan result in the evidence locker.

What does dcomply's scanner cover?

OWASP Top 10 (injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfig, XSS, insecure deserialisation, known vulnerable components, insufficient logging), TLS/cipher weaknesses, exposed admin panels, common misconfigurations, and CVE-based CVSS scoring for identified components.

Is a scan the same as a penetration test?

No, a scan is automated and detects known vulnerabilities; a penetration test is manual and finds business-logic flaws, chained exploits and novel weaknesses. Regulated entities need both: scans quarterly, VAPT annually. dcomply's scanner covers the quarterly cadence and produces evidence for the VAPT engagement.

How does dcomply integrate scan results with compliance evidence?

Every scan result is automatically attached to the ISO 27001 A.12.6, SOC 2 CC7.1 and RBI Cybersecurity Framework controls it satisfies. On the audit-report page, an auditor sees the scan date, findings, remediation status and remediated-by date, no separate evidence collection needed.

Does the scan meet CERT-In requirements?

CERT-In requires annual VAPT of critical information infrastructure by a CERT-In empanelled auditor. dcomply's scan by itself does not qualify. CERT-In VAPT must be human-led by an empanelled firm. But dcomply automates the pre-VAPT preparation, evidence organisation and remediation tracking, reducing the empanelled auditor's time (and fees) by 30-40%.

Website & VA Scanner

Comprehensive Website Security & Compliance Scanner

Scan any website for DPDP compliance gaps, missing privacy notices, cookie issues, and security vulnerabilities, all in a single scan with actionable remediation steps.

Try the live product

// Scan Report Summary
Results: {
  compliance: "3 gaps found",
  security: "2 warnings",
  cookies: "5 undisclosed",
  score: "62/100"
}

100+ checkpoints scanned in under 60 seconds

The Problem

Your Website Is Your Biggest Compliance Risk

Most websites have compliance gaps and security vulnerabilities they don't even know about

Missing Privacy Notices

Many websites lack the required DPDP disclosures, no privacy policy, incomplete data collection notices, or missing consent mechanisms

Hidden Trackers

Third-party cookies and tracking scripts silently collect user data without proper consent, a direct violation of DPDP requirements

Security Vulnerabilities

Unpatched vulnerabilities, weak security headers, and misconfigured SSL expose personal data to breaches, triggering mandatory reporting obligations

Capabilities

Security Meets Compliance in One Scan

DPDP Compliance Gap Analysis

Automated checks against DPDP Act requirements, privacy notices, consent mechanisms, data principal rights, and purpose limitation disclosures.

OWASP Top 10 Vulnerability Check

Scan for the most critical web application security risks including injection flaws, broken authentication, cross-site scripting, and misconfigurations.

Cookie & Tracker Detection

Identify every cookie and third-party tracker on your website, first-party, third-party, analytics, advertising, and flag those missing from your consent banner.

Missing Privacy Notice Detection

Automatically detect pages that collect personal data but lack proper privacy disclosures, forms without notices, tracking without consent, and more.

SSL/TLS & Security Header Checks

Verify SSL certificate validity, check for HSTS, Content Security Policy, X-Frame-Options, and other security headers that protect user data in transit.

Professional PDF Reports

Download detailed, branded PDF reports with executive summaries, risk scores, finding details, and step-by-step remediation guidance for your team.

How It Works

One URL. 100+ Checks. Instant Results.

No agents to install. No code changes needed. Just enter your URL and get a complete compliance and security picture.

Enter your website URL

Simply paste your website URL into the scanner. No installation, no configuration, no access credentials required.

Our scanner analyzes 100+ checkpoints

The scanner crawls your website and runs 100+ compliance and security checks, cookies, trackers, privacy notices, SSL, headers, and OWASP vulnerabilities.

Get a detailed report with risk scores

Receive a comprehensive report with an overall compliance score, categorized findings, and severity ratings for every issue detected.

Follow remediation steps to fix issues

Each finding comes with clear, actionable remediation guidance, prioritized by severity so you know exactly what to fix first.

Scan Your Website for Free

Find out where your website stands on DPDP compliance and security in under 60 seconds.

View All Features