Platform overview
How the AXUM SEC platform is put together — two testing engines, one control plane, and where each capability lives.
AXUM SEC runs two models of offensive security on one control plane: crowd-sourced discovery through bug bounty and disclosure programs, and expert-led testing through PTaaS engagements. This document explains the structure behind both, and which part of the platform does what.
The problem the structure solves
Security testing is usually bought piecemeal: an annual penetration test here, a bounty program there, spreadsheets in between, and a finance team reconciling global payouts by hand. Each tool solves one slice, so the coordination cost grows with every addition.
The platform is built around the opposite assumption: scoping, testing, triage, remediation, payment and disclosure are one lifecycle, and they should share one source of truth.
Two engines, one control plane
| Crowd-sourced | Expert-led | |
|---|---|---|
| Model | Bug bounty, VDP, challenges and contests | PTaaS engagements |
| Who tests | The global researcher community, vetted per program | Certified, invited experts |
| Coverage | Continuous and broad | Scheduled, deep and structured |
| Best for | Breadth, continuous assurance, long-tail classes of bug | Depth, compliance evidence, complex or high-value targets |
| Commercials | Pay per validated finding | Fixed, tiered or subscription |
Both run against the same scope definition, the same triage pipeline and the same remediation trail. That is what makes the combination useful rather than duplicative: the crowd keeps testing between engagements, and experts produce the scheduled, defensible evidence that auditors and customers ask for.
What sits around the engines
Every program — crowd or expert — is supported by the same platform services:
- Identity and access — standards-based token authentication, OAuth sign-in, TOTP multi-factor authentication, role-based access for every participant type, and session revocation.
- Secure collaboration — an encrypted evidence store, malware scanning, in-app notifications, email notifications and realtime chat.
- AI assistance — classification, duplicate detection, remediation guidance and report drafting applied to the parts of triage that do not scale by hiring.
- Financial operations — multi-currency wallets, per-program and per-engagement budgets, subscription management, usage metering and invoicing.
- Global payouts and tax — tiered KYC, payout channels in several rails, withholding calculation, digital tax forms and annual reporting workflows.
- Integrations — Jira, GitHub, GitLab, Azure DevOps, Slack and Microsoft Teams, so remediation lands where engineering already works.
Program lifecycle in one timeline
- Create the program. Choose a program model, define scope, set reward tiers and rules of engagement, and invite collaborators.
- Onboard participants. Researchers accept the program policy; experts accept an NDA and receive scoped, time-limited credentials.
- Receive and triage submissions. Reports move through review, validation and duplicate checks, with every state change visible to the reporter.
- Reward and record. Valid findings are priced against the program's severity model, and the reward is recorded against the budget.
- Remediate and verify. The fix is tracked to closure and, where the program requires it, confirmed by a retest.
- Disclose and report. Coordinated disclosure, advisories and recognition happen on the same record, with an audit history that can be exported.
Where each capability lives
| Customer-facing area | Backing capability |
|---|---|
| Program models, scope, tiers, rules of engagement | Program and engagement management |
| Crowd-sourced discovery | Researcher programs, submissions, reputation and leaderboards |
| Expert engagements | Engagement management plus expert identity, invitations and entitlement checks |
| Identity, MFA, roles, sessions | Authentication and access decision service |
| AI triage, duplicate detection, remediation guidance | AI enrichment pipeline |
| Notifications, chat, disclosure workflows | Messaging and templating services |
| Wallets, budgets, subscriptions, incentives, invoicing | Financial operations service |
| Payouts, KYC, withholding, tax forms | Payout, tax and reporting workflows |
| Encrypted evidence storage, malware scanning | Encrypted file service with scanning and quarantine |
| API surface, authentication enforcement, rate limiting | API gateway |
These are service boundaries rather than marketing groups — "one platform" is a structural property, not a positioning line.
Availability and limits
- Fine-grained role-based access control, MFA and audit trails are part of the platform's baseline security model.
- Some capabilities are plan-dependent. Advanced researcher vetting, dedicated tester pools, custom severity scoring, threat modelling assistance and custom disclosure timelines are Enterprise-tier. Private researcher access, AI triage, duplicate intelligence, automated payouts, compliance exports, historical analytics, VPN access, source code review and retesting are Professional-tier.
- The platform handles withholding calculation, form generation and reporting workflows; it does not replace your own tax or legal counsel.
Related docs
- Program models — the nine ways to structure a program
- Scope and rules of engagement — how boundaries are defined and enforced
- Triage pipeline — what happens after a report arrives
- Identity and access — the access model behind every participant type