Vulnerability intelligence from scan to report. Nmap NSE scanning enriched with live NVD CVE data, MITRE ATT&CK mapping, Metasploit module suggestions, and professional PDF-quality HTML reports — in a single native GUI.
Most vuln scanners stop at "here's a finding." HawkEye takes you from raw port to professional report with ATT&CK context and MSF commands at every step.
No tab-switching between five different tools. No copy-pasting CVE IDs into NVD. No writing reports by hand.
vuln script category plus HTTP, SSL, SMB, and service-specific scripts. Parses XML output into structured findings automatically.The ATT&CK tab shows which techniques were triggered across all findings — grouped by tactic, counted, and linked directly to MITRE. Know exactly where the attack surface is before you write a word.
Fill in client name, author, and classification. Click Generate. An HTML report opens in your browser — print to PDF or send as-is. Same format your clients expect.
Nessus and OpenVAS find network vulnerabilities. Acunetix leads in browser-based web app DAST. Neither gives you automated kill chains, PDF reports, Jira/Slack push, or scan history diffing. HawkEye does all of it — 7 phases, browser-engine DAST (DOM XSS, CSTI, prototype pollution), OOB blind injection, CMS scanning, OSV dependency scanning, JWT/CSRF/LDAP checks, EPSS + CISA KEV enrichment, automated MITRE ATT&CK kill chains, and 9K+ Nuclei templates — in a single operator-grade desktop tool. No subscription. No cloud. Your data stays yours.
| Capability | ◈ HawkEye | Nessus | OpenVAS | Acunetix | Intruder | Indusface | ManageEngine | SiteLock | Tripwire |
|---|---|---|---|---|---|---|---|---|---|
| Network / infrastructure scanning | ✓ Nmap NSE | ✓ 185K plugins | ✓ 80K NVTs | basic | ✓ | partial | ✓ agent | ✗ | ✓ enterprise |
| Web app scanning (DAST) | ✓ + 9K templates | basic plugins | basic | ✓ best-in-class | ✓ | ✓ OWASP | web agent | malware only | ✗ |
| JavaScript / SPA scanning | ✓ Phase 6 CDP | ✗ | ✗ | ✓ Chromium | partial | partial | ✗ | ✗ | ✗ |
| API scanning (OpenAPI / GraphQL) | ✓ spec + GraphQL | ✗ | ✗ | ✓ spec import | partial | partial | ✗ | ✗ | ✗ |
| Live NVD CVE enrichment (real-time) | ✓ NVD API v2 | vendor cycle | vendor cycle | web CVEs only | ✓ | ✓ | ✓ | ✗ | ✓ |
| MITRE ATT&CK auto-mapping | ✓ 14 tactics | ✗ | ✗ | ✗ | ✗ | ✗ | partial | ✗ | ✗ |
| Metasploit module suggestions | ✓ per-CVE | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| ExploitDB PoC fetch + scaffold | ✓ live fetch | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Kill chain / scenario builder | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| OWASP Top 10 mapping | ✓ | partial | ✗ | ✓ | partial | ✓ | ✗ | ✗ | ✗ |
| Stealth / custom scan profiles | ✓ 5 profiles | partial | partial | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Professional report (one click) | ✓ built-in | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | basic | ✓ |
| Native desktop GUI | ✓ Rust/egui | ✗ web UI | ✗ web UI | ✗ SaaS | ✗ SaaS | ✗ SaaS | ✗ web UI | ✗ SaaS | ✗ web UI |
| Open source | ✓ GitHub | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Price | €100/mo | $4,390/yr | Free | $4,995/yr+ | $101/mo+ | $59/app/mo | $695/yr | $15/mo+ | Enterprise |
One seat per operator. Licensed per operator year — usage is registered server-side for compliance and audit purposes.
Chromium headless engine with Chrome DevTools Protocol (CDP). Detects vulnerabilities invisible to static HTTP scanners: DOM-based XSS (URL param → dangerous sink, fragment injection), client-side template injection (Angular/Vue/React), prototype pollution via JSON.parse, postMessage origin bypass, open redirects in JS routing, sensitive data in localStorage/sessionStorage, SPA framework dev-mode detection, and dynamic form endpoint discovery.
Automated kill-chain engine with 15+ MITRE ATT&CK patterns. Detects multi-step attack paths from your findings: SQLi→credential dump→pivoting, XSS→session hijack→account takeover, SSRF→cloud metadata→IAM theft, subdomain takeover→phishing, prototype pollution→RCE, and more. Includes remediation priority roadmap (CVSS + EPSS + CISA KEV), scan history with delta comparison, and push integrations for Jira, Linear, Slack, and generic webhooks. One-click PDF export via headless Chromium.