Vulnerability scanning
Authorize scope, schedule assessments, interpret authentication coverage, and verify remediation.
Vulnerability scans assess authorized assets for exposed services, configuration weaknesses, and known vulnerabilities. A successful scan job does not mean every check succeeded or that the target is free of vulnerabilities.
Authorize scope
An Administrator opens Assessments → Scopes → Create scope, selects owned assets, records the authorizing owner, and defines permitted hostnames, addresses, exclusions, scan windows, and scanner location. Ownership verification and an approved scope are required. Third-party infrastructure requires explicit authorization from its operator; a DNS entry alone does not authorize testing every shared host behind it.
Set concurrency and request intensity to values approved by the service owner. Exclude fragile systems until their operator has reviewed the check profile. The scanner must resolve and reach targets from its selected network location. A self-hosted scanner inside a private network observes a different exposure boundary from an external scanner.
Create a schedule
The standard coverage cadence is weekly automated scanning with quarterly authenticated coverage reviews. Authenticated checks can also run weekly when the credentials, authorization, and service windows permit them; the schedule preview shows the configured cadence.
- Open Assessments → Scans → Create schedule. Choose the approved scope, profile, enrolled scanner, time zone, and credential reference.
- At Schedule → Preview, inspect the next runs and resolved targets against the approved testing window and address ranges.
- Select Run now for a pilot. Open Assessments → Runs → Run and inspect target coverage and authentication before enabling recurrence.
- Enable the recurring schedule only after the pilot completes its required checks. If the pilot reports reachability or authentication failures, correct the recorded cause and repeat the pilot within the approved window.
Scope revisions are pinned to each run. Newly resolved addresses outside the approved range are excluded and reported, not silently added to scope.
Read results
Open Assessments → Runs → Run. Inspect discovery, target reachability, credential validation, completed checks, skipped checks, and errors. Run states are queued, running, succeeded, failed, or canceled; a completed run can contain target-level coverage gaps. An unreachable target is not_assessed, not clean.
Each finding records the asset, affected service or package, detector, evidence summary, first/last observation, severity, and authentication basis. Version-only findings can require manual confirmation. The absence of a detection does not establish that a code path was exercised.
Cancel, recover, and retire
Use Run → Cancel to stop further scheduling and cancelable checks. Requests already sent cannot be recalled. Fix reachability or credentials, then create a new run; do not rewrite the failed run's history. Disable a schedule under Schedule → Disable before retiring its scope. Retained runs and findings follow retention. See Assessment API.