The apps you never onboarded are the ones you cannot see.
Finance ships a dashboard. HR ships a portal. An AI tool ships an internal service. None of them will ever open a security console, and your coverage quietly stops at the edge of what engineering told you about.
Coverage decays silently
Nothing turns red when an application is missing from the program. The dashboard stays green, the scan schedule keeps passing, and the report reads clean, because the application that nobody onboarded was never in scope to begin with. The growing application attack surface is not mostly new vulnerabilities in the apps you already test. It is applications you were never told about.
These builders are not going to adopt a security tool
The app never passed through CI
A tool that only tests what moves through a build pipeline cannot see an application that was assembled in a low-code builder, generated by an AI assistant, or deployed by hand.
There may be no repository at all
Static analysis needs code you can reach. When the builder is a business team, the code is often somewhere you do not have, in a form you cannot parse, or it does not exist as a repository.
Nobody on that team owns this
Programs that scale through developer enablement assume a developer to enable. The finance analyst who built the dashboard is not going to triage findings or add a scan step.
You cannot schedule what you have not found
Asking teams to self-report applications produces the list of applications teams remember to report. The gap between that list and reality is where the risk sits.
A URL is enough to run a real test
NightVision starts at the black box rung, which is the rung that works when the builder is not a participant. Your security team points it at the running application and gets a genuine test, not a surface-level check.
Point it at the app
A URL or an uploaded spec is enough. No source access, no agent to deploy, no change to the application, and nothing for the person who built it to install.
Test it fully authenticated
A real browser walks the application through a Playwright-recorded login with vaulted credentials, MFA included, so the scan reaches the states an unauthenticated check never sees.
Get evidence, not a guess
Request-level findings retain the HTTP request and response and a curl command that reproduces them, which is what makes a finding actionable for a team that did not write the code.
Internal-only applications are covered on the same terms: see private network scanning.
Start black box, add source and agents where they exist
The same engine runs underneath every entry point, so coverage of the apps nobody onboarded and coverage of your engineering organization are not two separate programs. Where there is a repository, add source discovery and Code Traceback. Where there is a pipeline, gate the build. Where your developers already run coding agents, let those agents drive the scan and propose the fix. Nothing has to be re-platformed to move up a rung.
See all four entry points on the platform overview, or go straight to NightVision for coding agents.
Same team, far more surface.
Questions from security teams
How do you test an application when you do not have its source code?
A URL is enough. NightVision drives a real browser through the running application, fully authenticated including MFA, and reports findings with the HTTP request and response retained as evidence. Source access adds file and line context on supported source-discovered API findings, but it is not required to run a scan.
Do the people who built the application have to install anything?
No. Scanning is driven by the security team against the running application. There is no agent to deploy, no library to add, and no change to the application itself, which is what makes it workable for applications built by teams outside engineering.
Does this replace the application security team?
No. The security team stays the owner and the reviewer. NightVision is leverage: the same team covers far more applications because onboarding an application does not require the cooperation of whoever built it.
What about applications on internal networks?
Internal applications are frequently the ones built outside engineering. NightVision can scan targets that are not reachable from the public internet, so internal dashboards and portals are testable on the same terms as external applications. See private network scanning.
Cover the applications nobody told you about.
Book a demo and bring the app you are least sure about, or start free and point a scan at it yourself.