1. [Home](https://www.g2.com/) 2. ... 3. [Product Analytics Software](https://www.g2.com/categories/product-analytics) 4. [Vexta Discussions](https://www.g2.com/products/vexta/discuss) [ ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/large_detail/large_detail_e961d253c3b10ed6e6f62a21c3c588bb/vexta.svg "Product Avatar Image") ](/products/vexta/reviews) [ Vexta ](/products/vexta/reviews) 0 ratings Vexta is a self-hosted vulnerability scanner and penetration testing platform that verifies its findings before you read them. Most scanners match software versions against a CVE feed and hand back a long list that your team then has to triage by hand. Vexta runs each candidate finding through a non-destructive verifier that safely tries to confirm it, then marks it proven, refuted or unproven. A network error never turns into a false "refuted": the finding stays unproven. Vexta tests web applications, APIs and hosts for more than 25 vulnerability classes, including SQL injection, cross-site scripting (XSS), SSRF, SSTI, XXE, IDOR and broken access control, HTTP request smuggling, GraphQL flaws and SSO, OAuth and SAML authentication bypass. It starts with reconnaissance from more than 40 passive sources plus active discovery, mapping subdomains, endpoints, technologies and exposed services. More than 10,000 community detection templates from ProjectDiscovery's open-source nuclei-templates are bundled, and what they flag is checked by Vexta's own verifiers. WAF-aware throttling keeps scans quiet. Every finding gets a 0-100 Vexta Confidence Score that combines severity, detector confidence and proof status, plus EPSS probability and CISA KEV status on Pro and Enterprise and asset reachability on Enterprise. Sorting by it puts the issues worth fixing first. Optional AI triage adds context and remediation guidance and flags likely false positives without ever deleting a finding. It uses your own Anthropic, OpenAI, Gemini or Azure OpenAI key and stays off unless you turn it on. Vexta is agentless and runs as a single binary on Linux, macOS or Windows, with no Docker or external database. Scan results, findings and audit logs stay on the machine where it runs unless you turn on an integration that sends them out, and it can run on air-gapped networks. SARIF and JUnit output plug into GitHub Code Scanning, GitLab, Jenkins, CircleCI and TeamCity, and reports export to HTML, PDF and Word with an executive summary and remediation steps. Three plans unlock features from the same binary. Essentials suits solo researchers and small teams. Pro adds the full proof-of-exploitation engine, an intercepting proxy, proof-of-concept generation and export to HackerOne and Bugcrowd. Enterprise adds multi-seat role-based access, attack-path chaining, ASPM reachability scoring and compliance reporting mapped to OWASP, NIST, PCI DSS and SOC 2. A 14-day free trial of Pro needs no card. Vexta is built by VITI Security, which also uses it on its own VAPT engagements. Show More When users leave Vexta reviews, G2 also collects common questions about the day-to-day use of Vexta. These questions are then answered by our community of 850k professionals. Submit your question below and join in on the G2 Discussion. * * * ### 0.0 Nps Score ### All Vexta Discussions Search Most CommentedMost HelpfulCommon QuestionsNewest All DiscussionsDiscussions with CommentsCommon QuestionsDiscussions without Comments FilterFilter Filter byExpand/Collapse Sort by Most Commented Most Helpful Common Questions Newest Filter by All Discussions Discussions with Comments Common Questions Discussions without Comments Sorry... There are no questions about Vexta yet. ## Start a New Software Discussion Have a software question? Get answers from real users and experts [Start A Discussion](/products/vexta/discussions/new?entry_point=discussions%23product) * * * ![Product Avatar Image](https://images.g2crowd.com/uploads/product/hd_favicon/e961d253c3b10ed6e6f62a21c3c588bb/vexta.svg "Product Avatar Image") ### Have you used Vexta before? Answer a few questions to help the Vexta community [ Yes ](javascript:void(0))[ Yes ](https://www.g2.com/login?context=product_review&return_to=https%3A%2F%2Fwww.g2.com%2Fproducts%2Fvexta%2Fdiscuss%3Fsmall_ask%3Dvexta) No