Probely is a web application and API vulnerability scanner. It is built for developers, security teams, DevOps and compliance teams, and SaaS businesses that need to find vulnerabilities in what they ship and understand how to fix them.
The problem it addresses is the gap between finding a vulnerability and getting it fixed: a scanner is only useful if developers trust and act on what it reports.
At A Glance
| Vendor | Probely |
|---|---|
| Category | Application security, web application and API vulnerability scanning |
| Deployment | Cloud service, with an agent to scan internal targets |
| Coverage | More than 100 vulnerability types, over 30,000 individual vulnerabilities |
| Founded | 2016 |
| Market classification | Application Security |
What Probely Does
Probely works like a virtual security specialist added to a development team. Rather than handing developers a raw list of issues, the scanner explains each finding and how to fix it, and adjusts its severity to the context in which it was found, with evidence to show that the vulnerability is real. That makes it practical to put security testing into the normal development flow, with scans automated in pipelines and results synced both ways with the issue tracker a team already uses. One scanner covers classic web apps, JavaScript-heavy single page applications and APIs.
Products
Web Application Scanner
The web application scanner is the core of the product, aimed at teams that need repeatable testing of their sites and web apps. A Headless Chrome based spider lets it crawl rich, interactive JavaScript apps and sophisticated single page applications. Teams can run full scans across more than 100 vulnerability types, or partial and incremental scans when only part of an application has changed. Dashboards show each target’s findings, severity indicators and an average time to fix chart, so progress on remediation is visible.
API Vulnerability Scanning
API scanning is for teams whose risk sits in microservices and standalone APIs rather than in a browser front end. Probely builds its tests from an OpenAPI (Swagger) specification or a Postman Collection, and handles APIs that need dynamic authentication by extracting tokens during the scan.
Compliance Reports
Compliance reports help teams show auditors and managers where they stand. The scanner produces detailed management reports with requirements checklists and summaries for PCI-DSS, OWASP Top 10, ISO27001, HIPAA and GDPR.
Enterprise Administration
Larger organisations can add custom roles, teams and quotas, pause and resume scans, sign in with SSO and receive priority support.
How It Works
Probely runs as a cloud service. Each scan is limited to its target, and the scanner never goes beyond that scope. Applications that are not reachable from the internet are scanned through a dedicated scanning agent.
| Component | What it does |
|---|---|
| Authentication | The scanner can log in to the application under test through login forms, basic authentication, customisable cookies and headers, dynamic API authentication with token extraction, a login sequence recorder plugin and SSO with OpenID Connect. |
| Automation | A full-featured, documented API and CI tool plugins let teams start scans from their pipelines. |
| Hosting | The service runs on a major cloud provider, using Docker containers on Shielded VMs with Container Optimized OS, Kubernetes clusters and managed database services. |
| Platform security | All data is encrypted by default and all communication uses TLS. Administrative access requires two-factor authentication and/or client certificates, and network access is denied by default through VPC firewalls and Kubernetes Network Policies. Probely scans its own assets daily and weekly and commissions a yearly grey box pentest. |
Integrations
| Area | Integrations |
|---|---|
| Issue tracking | Jira Cloud, Jira Server, Azure DevOps, Shortcut |
| Vulnerability management | DefectDojo |
| Messaging | Slack |
| CI/CD | Jenkins and CircleCI plugins |
Company Background
| Founded | 2016, by certified web security professionals with more than a decade of experience |
|---|---|
| Headquarters | Lisbon, Portugal |
| Funding | Backed by Bright Pixel and Caixa Capital |
Note: This overview is compiled from Probely’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.