Running a Scan

Everything you can configure when launching, monitoring and managing a scan.

The New Scan wizard

Step	What you do
Target	Choose the registered target to test and confirm its type. The target is added to the scan scope automatically.
Configuration	Choose the scan mode, authentication, scope, rules of engagement and optional advanced settings.
Review	Check the summary, sign the engagement agreement and launch or schedule the scan.

Scan options

Option	Description
Target type	Web application, repository, local code, IP address, Android APK, iOS IPA, AWS, Azure, GCP or AI application.
Scan mode	Quick, Standard, Aggressive or Thorough. See Scan Modes.
Additional targets	Add more targets to test several assets in one scan.
Rules of engagement	In-scope and out-of-scope assets and testing restrictions. Strongly recommended.
Additional instructions	Free-text guidance for the agents, such as "focus on the checkout flow".
Vulnerability focus	Prioritize categories: injection, XSS, authentication, SSRF, authorization, file inclusion, deserialization.
Focus and avoid patterns	Paths or patterns to prioritize, and paths the agents must never touch.
Max requests per second	Cap the request rate to protect fragile or production systems.
Max iterations	Upper limit on agent steps, from 1 to 10,000 (default 2,000).
AI model	Pick the model for this scan from the models your plan includes. See AI Models.
Compliance flags	Declare regimes such as PCI DSS so agents follow strict do-not-extract and redaction rules.
Context files	Upload documents, such as API documentation, to give agents background.
Run name	Give the scan a custom, searchable name.
Schedule	Run later at a date and time you choose.
Stealth mode	Route scan traffic through Tor. Available on Hacker and above.

Authentication

Most of your attack surface sits behind a login. Give Cyrion AI access and it tests as an authenticated user.

Basic, bearer token or API key headers.
Custom cookie and custom User-Agent headers.
Form-based login flow for sites with a login page.
TOTP / MFA for accounts protected by two-factor codes.
Secrets Vault credentials so passwords are never typed into a scan form. The scan carries a reference to the stored credential, never the secret itself, and you can rotate it in one place.

Tip: Create a dedicated test account with realistic permissions rather than using an administrator account.

Rules of engagement

Rules of engagement tell the agents what is allowed. Write them like a short brief:

IN SCOPE:
- https://app.example.com and *.example.com
- API under https://api.example.com/v2

OUT OF SCOPE:
- Payment provider callbacks
- Anything under /admin/backup

RESTRICTIONS:
- No destructive actions or data deletion
- Keep request rate under 20 requests per second

Engagement agreement

Each scan requires a signed Security Testing Engagement & Authorization Agreement. You confirm that you have read it, that you are authorized to test the target and that you accept responsibility for the engagement. Relaunching or cloning a scan starts a new engagement, so the agreement is requested again.

Pre-scan health check

Immediate scans run a quick readiness check first. It verifies that the target responds and that your account can run the scan, so a typo or an expired credential is caught before credits are spent. Scheduled scans skip this step and are validated when they start.

Scheduling

Choose Schedule for later in the wizard to run a scan at a specific date and time. Scheduled scans appear in Projects → Calendar, where you can see everything planned across your targets. Recurring scans are available through the scheduled scans API.

Monitoring a scan

Open any scan from the Projects board.

Live activity — see agent messages, tool executions and findings as they happen.
Agents — follow each agent, send it a message or stop it.
Attack chain — see how findings connect. See AI Agents & Toolkit.
Status — scans move through pending, running, paused, scheduled, completed and failed.

Managing a scan

Action	What it does
Pause / Resume	Stop work temporarily and continue from where it left off.
Stop	End the scan. Findings so far are kept.
Edit	Change target, instructions, mode, iterations, request rate or stealth. Changes apply on the next relaunch.
Relaunch	Run a stopped scan again. Requires a new engagement agreement.
Clone	Start a new scan with the same settings. Requires a new engagement agreement.
Investigate	Launch an investigation agent on a completed scan to dig deeper into a result.
Rename / Delete	Organize your project history.

Credits during a scan

Credits are metered by actual usage as the scan runs. If your balance runs out, the scan pauses and can be resumed once you add credits. See Credits & Usage.