Everything your team needs to work through findings, understand testing, and manage your security program.

Table of Contents

Getting Started

Welcome

Platform Onboarding

Testing Process

Using the Platform

Findings Management

Testing Activities

Reporting

Security Metrics & Analysis

Attack Surface

Account Management

Integrations

FAQs & Support

FAQs

Best Practices

:shield_logo: Welcome to Sprocket Security! :shield_logo:

INDY7933-2.jpg

<aside> <img src="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" alt="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" width="40px" />

Common Topics

Review findings, update statuses, assign remediation, and track progress.

Allows you to retrieve findings programmatically, with filtering and pagination support.

Understand testing timelines, activity history, and testing results.

Find answers to common questions about the platform, testing, and your security program.

</aside>

What’s New in the Sprocket Platform

Launch Apex on External Projects

Previously, only Web Application customers could launch on-demand attacks. Now Client Managers on External Pentest projects can launch Apex against a website in CPT scope, so you can test a change right after you ship it instead of waiting for the next scheduled run. Web Application customers can also now target any website in CPT scope with Apex, not only web apps.

See Launch Attack.

Web App Reporting_7.7.2026@4x.png

Score History Now Shows Your Numeric Score

Score History previously showed only your letter grade. It now plots your numeric Security Score, so you can see how each remediation moves your score, even before your grade changes, and how close you are to the next grade.

See Security Score.

Add New.png

WebApp_Form.png

Attack Narratives Search and Summary

Every test Sprocket runs against your environment appears in Attack Narratives. Search by name or ID, see counts of active, completed, and finding-producing attacks at a glance, and click through to each attack's run in Attack Activity.

See Attack Narratives.

Shared Reports Stay Fixed

Previously, a shared report could change as findings were updated, so recipients might see different data than you sent. Now a shared report stays exactly as it was when you shared it, the way a formal report should. Reports you haven't shared still update with your latest findings.

See Report Center.