Single Source of Finding
Every discovery from audits, automated scans, or penetration tests is recorded once with a single accountable owner and lifecycle treatment.
Client Service & Sub-Tenancy Control Plane
Client Accounts & Digital Properties
Your workspace allows you to run audits, WCAG 2.2 AA accessibility, AIO/GEO, and risk evaluations directly for your own clients. Add any client website URL at any time, run one-click audits, and export deliverables.
3
Active client web properties
86%
80+ Benchmark Achieved
12
WCAG, AIO & Plain English Briefs
Flag: OFF
Set under Team & Settings
Your Client Portfolio Roster
Select any client to run immediate audits, generate plain-English PDFs, or copy LLM remediation prompts
Client Name & ID
Monitored Digital URL
Industry Vertical
Assurance Scope
Audit Score
Action
Executive Line of Sight — CavScope
Unified Website Assurance Posture
CavScope ties every finding to one single source of truth—connecting website accessibility (WCAG 2.2 AA), security vulnerabilities, compliance controls, audit evidence, and remediation velocity in real time. Every score includes transparent feedback on how it was achieved and how to reach 90+.
82
/ 100
80+ Good
1 active critical risk
Target: 95%+
Opens the Risk Register.
80
%
4 of 5 mapped
SOC 2, GDPR, WCAG
Opens Controls.
75
%
3 approved artifacts
1 in review
Opens the Evidence library.
65
%
0 overdue actions
4 treatments active
Opens the Remediation schedule.
Priority Risk Exposure
Highest severity website findings requiring accountable executive decisions
Governance & Attention
Escalation thresholds and policy bounds
Risk Appetite Tolerance
Within Tolerance
Zero critical vulnerabilities allowed on public authenticated endpoints.
Active Exceptions & Alerts
Cross-Framework Traceability
Map one finding directly to SOC 2, ISO 27001, GDPR, WCAG 2.2 AA, and PCI DSS obligations without duplicating compliance worksheets.
Verifiable Remediation
Treatments are never signed off on word-of-mouth. Explicit evidence artifacts and control re-tests validate closure.
CavScope — Digital Accessibility Architecture
Enterprise WCAG 2.2 AA Accessibility Engine
Accessibility is a system requirement, not a cosmetic enhancement. Audit, remediate, and validate digital experiences against WCAG 2.2 Level AA, Section 508, and EN 301 549 standards across semantic HTML, keyboard-only operation, focus management, screen readers, and 400% reflow.
Overall Accessibility Health Index
84
/ 100
80+ Good · 90+ is Better
One P0 keyboard trap and a handful of missing icon labels are the only blockers standing between this site and a 95+ conformance rating.
12 Accessibility Architectural Dimensions (Rated 0–10)
WCAG 2.2 Defect Register & Remediation Queue
Actionable, non-vague findings classified by user impact: P0 Blocker, P1 Critical, P2 High, P3 Moderate, P4 Low
Severity
WCAG Criterion
Component & Barrier
Root Cause & Fix
Validation
Action
Accessible Code Pattern 01
Accessible Dialog with Focus Trap & Escape (Native HTML)
<!-- Native <dialog> provides built-in backdrop, focus trap, and Escape handling -->
<dialog id="checkoutModal" aria-labelledby="dialogTitle" aria-describedby="dialogDesc">
<div class="dialog-content">
<h2 id="dialogTitle">Confirm Subscription Change</h2>
<p id="dialogDesc">Review your plan details before proceeding to payment.</p>
<form method="dialog">
<button type="button" onclick="this.closest('dialog').close()">Cancel</button>
<button type="submit" class="btn-primary">Confirm & Pay</button>
</form>
</div>
</dialog>
<script>
// Trigger must preserve reference to return focus on close
function openAccessibleDialog(triggerBtn) {
const dlg = document.getElementById('checkoutModal');
dlg.showModal(); // Automatically traps focus inside
dlg.addEventListener('close', () => triggerBtn.focus(), { once: true });
}
</script>
Accessible Code Pattern 02
Accessible Form Field with Explicit Validation Errors
<!-- Label explicitly associated; instructions & errors linked via aria-describedby -->
<div class="form-group">
<label for="userEmail">Work Email Address <span aria-hidden="true">*</span></label>
<input
type="email"
id="userEmail"
name="email"
required
autocomplete="email"
aria-required="true"
aria-invalid="true"
aria-describedby="emailHint emailError">
<small id="emailHint">We will send your audit verification code here.</small>
<div id="emailError" class="error-msg" role="alert">
<span class="sr-only">Error: </span>Enter an email address in the format name@example.com.
</div>
</div>
Reference
Findings Glossary
Every finding CavScope can raise, in plain English: what it means, how serious it usually is, and what fixing it involves. Open one at a time. The list is read from the same catalog the scanner uses, so it always matches what a scan can report.
A finding is evidence of one condition on one date. A scan with none of these means those checks passed that day. It does not mean a site is secure, and CavScope cannot see everything, such as sign-in areas or anything behind a login. A finding that says "Not currently checked" is defined here but is not part of scans today.
Reference
Framework Glossary
Every framework, law and standard CavScope cites, in plain English: what it is, who actually assesses against it, and how many of CavScope's checks cite it. Open one at a time. Citing a framework says which family a finding belongs to. It is not a test of that framework.
CavScope is not an assessor, an auditor or a lawyer. A framework named here is a citation: a finding is placed in the family it belongs to, and a control is derived from the findings that cite it. Whether a law applies to you can depend on where your customers live, which a scan cannot see, and that question belongs to your counsel. Where no active check cites a framework, nothing about it is concluded either way.
AI Assurance | TEVV Evaluation
AI Assurance
Every scan of this site also looks at what its public pages show about AI: chat assistants, AI features, disclosures, AI policies and ways to reach a person. That is evidence about what the site says, not about how its AI behaves. For an AI system your organization owns, you can authorize CavScope to test it directly. Both are built on NIST AI 200-2 ipd, the TEVV-Athlon Framework, an initial public draft that describes how to construct an evaluation. It sets no score and no certification, so none is shown here.
Sample data
CavScope — AI Optimization Framework
AIO & Generative Engine Optimization (GEO) Audit
Prioritize technical readiness for AI crawlers (GPTBot, ClaudeBot, PerplexityBot) across 5 core pillars: Crawlability & Rendering, Entity Clarity, Schema.org JSON-LD Structured Data, LLM Surface (`/llms.txt`), and Citability. Generates a client-ready, billable technical roadmap.
https:// 🔒
Client Intake Presets:
[SYSTEMS] AIO Audit Engine Ready. Enter client URL and launch inspection.
Clear English Assurance Report — CavScope
Plain English Executive Briefing
Explained in clear language that anyone can understand without technical jargon. Ready for executive review, non-technical clients, or sending as a PDF.
Enterprise Issue Workflow
Risk Register & 5×5 Matrix
Non-duplicative register of website findings, threat vectors, severity classifications, and accountable remediation assignments.
5×5 Risk Exposure Heatmap
Likelihood versus Impact distribution for active website findings (Click cell to filter)
Impact (1→5)
Likelihood (1→5)
Severity Distribution
Current portfolio breakdown
Critical Severity
0
High Severity
0
Medium Severity
0
Low Severity
0
Risk & Asset
Severity
Source
Owner
Treatment State
Action
Framework Alignment Traceability
Framework Control Mapping
Map regulatory frameworks (SOC 2, ISO 27001, GDPR, WCAG 2.1, PCI DSS, NIST CSF) directly to underlying operational website assets and active findings.
Framework / Code
Obligation & Scope
Owner
Assessment Status
Modify
Audit Readiness
Evidence Artifact Library
Maintain immutable, timestamped audit proof for framework controls, automated telemetry scans, and remediation sign-offs.
Evidence Artifact
Type
Reviewer & Source
Review Status
Review Action
Accountable Execution
Remediation Action Plan
Track actionable treatments, engineering assignments, due dates, and completion milestones without creating parallel, disconnected ticket queues.
Remediation Task & Finding
Target Due Date
Owner
Completion Progress
Status
Executive Assurance Briefing — CavScope
Board & Committee Risk Report
Exportable, high-level posture narrative linking open risk exposure, control coverage confidence, and treatment execution.
Enterprise Governance
Risk Appetite & Decision Guardrails
Define enterprise tolerance boundaries, govern formal exceptions, set strategic assurance objectives, and maintain an immutable decision log.
Policy Statement
Formally Approved
Risk Appetite & Tolerance
The enterprise maintains zero tolerance for unmitigated critical vulnerabilities on consumer-facing web properties and allows a maximum threshold of two high-severity findings with approved mitigation roadmaps.
Critical Tolerance
0 Allowed
High Tolerance
2 Allowed
Cadence
Quarterly
Approved Risk Exceptions
Time-bound, accountable deviations from security policy
Operational Assurance
Continuous Control Testing & Validation
Validate operating effectiveness of controls through scheduled walk-throughs, automated scans, and independent validation tests.
Control Testing Records
Formal assessments of control operating effectiveness
Control Test Name
Test Period
Tester / Assessor
Effectiveness Result
Action
Workspace
Team & Settings
Who is on this workspace, the API keys its agents use, how its reports are branded, and whether its findings are narrated by its own language model.
Team, invitations and API keys
Sign in to a live workspace to manage its members, pending invitations, agent API keys and AI narrative model. The sample walkthrough has none of these.
🏷️ Report Branding
Put your agency's name, mark and disclaimer on SITREPs and client deliverables instead of CavScope's.
Sample data: turn the preview on to see how agency branding changes the reports.