Documentation
Getting started with Wakefield.
Overview
Wakefield continuously finds and exploits vulnerabilities in your web applications. Our agents understand the business logic and access control model of each application, allowing them to discover logic-based vulnerabilities that traditional scanners miss — with zero false positives.
Getting Started
- Add your assets. Wakefield automatically discovers your public-facing assets. You can also add internal assets manually and configure VPN access for staging or development environments.
- Provide credentials. For authenticated testing, add test credentials for your applications. Wakefield uses these to log in and explore all features the way a real user would.
- Enable continuous testing. Select which assets to continuously test. Wakefield agents will begin crawling, reverse-engineering API specs, building access control models, and testing for vulnerabilities automatically.
Vulnerability Findings
When vulnerabilities are discovered, they appear in your dashboard with severity ratings, detailed descriptions, reproduction steps, and remediation guidance. Findings can be triaged, assigned, and tracked through resolution. You can also export findings to PDF reports for compliance or stakeholder review.
Custom Agents
Use the custom agents feature to run targeted security tests on specific endpoints or workflows. Type a natural language prompt describing what you want to test, optionally attach API documentation, and get results in minutes. This is useful for quick checks during development or before deploying new features.
Integrations
Wakefield integrates with your existing workflow tools. Vulnerability findings can be automatically sent to Jira, Linear, or Slack. You can also configure custom webhooks for any other system.
User Provisioning and SSO
Wakefield supports SAML 2.0 and OpenID Connect (OIDC) single sign-on. Customer-facing SCIM provisioning is not currently available.
Organizations can provision users through:
- Email invitations managed under Settings → Members.
- Just-in-time SSO provisioning for all users authenticated by the configured identity provider.
- Group-restricted JIT provisioning based on identity-provider group claims.
- Invite-gated SSO, where authentication succeeds only for previously invited members.
Organization owners deprovision users under Settings → Members. Removing a member removes their organization access and revokes active API keys they created for that organization. Because SCIM is not supported, identity-provider changes do not automatically delete existing Wakefield memberships.
Support
For product support, contact support@alkonos.ai. For security-related inquiries, contact security@alkonos.ai.