PoV

Last updated: Oct 26, 2026

---

Fluid Attacks goes beyond a PoC (Proof of Concept) and gives possible customers a PoV (Proof of Value). A PoC shows that a solution works. A PoV also shows if that solution is the right one for your company. The PoV shows the value that the Fluid Attacks solution has for your business. Thus, it is easier to justify the decision to use it.

This page gives detailed information about the scope, requirements, and workflow of the Fluid Attacks PoV.

Scope

The Fluid Attacks Proof of Value shows organizations the quantitative and qualitative value of the primary AppSec solution of Fluid Attacks: the Advanced plan. Fluid Attacks and the organization agree on the PoV explicitly. The PoV has this scope:

• Access to the platform: The organization can use the platform without limits during all of the PoV.
• Downloadable resources: Executive reports, Technical reports, and Group certificates.
• Information retention: If the organization does not become a customer of Fluid Attacks, Fluid Attacks removes all the data of the organization from the platform. The removal occurs two (2) weeks after the end of the PoV.

Requirements

Obligatory for the application to test

• It must be a complete web or mobile application (back end and front end, not only APIs).
• It must be in a Git repository that repository managers such as GitLab, GitHub, Bitbucket, or Azure can access.
• The organization must give Fluid Attacks access to the Git repository with read and clone privileges.
• If the repository is on a private network, not in the cloud, the organization must give Fluid Attacks the necessary permissions for the connection.
• The application must be in a continuous development lifecycle. The development team of the organization must make changes regularly during the PoV.
• The associated environment must be available 24/7 for continuous testing.

Expected

Fluid Attacks recommends these conditions:

• The application has more than 200 thousand lines of code (without third-party libraries).
• The organization has a fully configured CI pipeline.
• The development team of the organization has at least five (5) developers from the previous month and during all of the PoV.
• The project manager of the organization attends a weekly 30-minute follow-up meeting with the Fluid Attacks engagement manager.
• The team of the organization remediates at least 30% of the reported vulnerabilities during the first half of the PoV.

By the end of the PoV

The organization must do these tasks:

• Give feedback about the experience in a satisfaction survey or a short conversation.
• Write a review of the platform on Gartner Peer Insights.
• Recommend the experience to other organizations.
• Make a short video or podcast testimonial about the PoV.

Workflow

These are the activities that occur during the PoV. The organization and Fluid Attacks agree on the length of the PoV. Usually, the PoV continues for sixty (60) days.

Planning

1. Definition of the target of evaluation (ToE): The organization gives the names and types of the applications to test. It also gives the associated repositories, branches, and environments. It also generates the credentials for each application.
2. Identification of responsible parties: The organization identifies the persons in its team who manage the projects, remediate vulnerabilities, and control software deployment.
3. Definition of the type of connection: The Fluid Attacks engagement manager helps the organization with this definition. First, the organization selects the cloud or a private network for the connection. Then, it selects OAuth, SSH, or HTTPS for the access to the repositories.
4. Scheduling of a kick-off meeting.

Guidance

1. Kick-off meeting: The engagement manager shows the Fluid Attacks platform to the team members of the organization. Then, they connect to the applications and get access to the repositories. Finally, they schedule onboarding and follow-up meetings.
2. Onboarding meetings: When it is necessary, Customer Success meets with the team of the organization. In these meetings, Customer Success teaches the team how to use the platform and its plugins. It also tells the team about other integrations, the CI Gate, and more.
3. Follow-up meetings: The Fluid Attacks engagement manager, the project manager, and other stakeholders of the customer meet weekly. They examine their experiences and results in the PoV.

Implementation

• Automated security testing: The Fluid Attacks scanners continuously search for vulnerabilities in the ToE during different phases of its development lifecycle. They use SAST, Web DAST, API DAST, SCA, and AI SAST techniques.
• Manual security testing: First, AI helps to prioritize the files that can be vulnerable. Then, the Fluid Attacks team of pentesters continuously searches for security issues in the ToE. The team uses methods such as manual pentesting, secure code review, and reverse engineering.
• Vulnerability management: The team of the organization assigns the vulnerabilities and remediates them. The team uses the reports on the platform and, if necessary, explanatory sessions with the Fluid Attacks experts. The team can also use generative AI on the platform or the VS Code plugin to get fix suggestions. Also, when the team wants to make sure that a remediation is correct, it requests a reattack. The team can also set policies to break the build with the CI Gate when the software has unacceptable vulnerabilities before it goes into production.

Completion

1. Executive briefing: Stakeholders of the customer and of Fluid Attacks meet for about one hour. Examples of customer stakeholders are the CTO, the CISO, and the technical security and DevOps leaders. Examples of Fluid Attacks stakeholders are the engagement manager and the account executive. They present and discuss the final results of the PoV.
2. Feedback and referral: The organization writes a review on Gartner Peer Insights. It also invites other companies to do a PoV.
3. Conversion: When the PoV is complete, the organization makes its decision: it becomes a customer of Fluid Attacks, or it does not. Then, it tells Fluid Attacks the decision.

After the PoV ends

After the PoV ends, Fluid Attacks keeps the data for two (2) weeks.