Quick start
From your invitation email to your first verified finding, in six steps.
Before you start
Zaaf creates your organization and sends an invitation to each person on your team. You need the invitation email and an authenticator app such as 1Password, Google Authenticator or Authy.
1. Accept your invitation
Open Set up your account in the invitation email and choose a password of at least 12 characters. The link is valid for 7 days; if it has expired, ask your Zaaf contact for a new one.
2. Turn on two-factor authentication
Two-factor authentication is required for everyone. Scan the QR code with your authenticator app and enter the 6-digit code it shows. More about signing in.
3. Add an asset
Go to Assets and choose Add asset. Pick the type, give it a name your team will recognise, and enter its address, app identifier or repository.
4. Add a test account
Open the asset and choose Add test account. Agents sign in with it to test what a real user can do. Without one, you can still run a Blackbox scan. Test accounts and source code.
5. Start a scan
In the asset's Start a scan section, pick Blackbox, Graybox or Whitebox. Countermind takes you to Scans, where you can follow the agents live.
6. Work through your findings
When a researcher publishes a finding, it appears in Findings and your organization's alert address receives an email. Fix it, then choose Request retest to have Zaaf confirm the fix. Work with findings.