Run a Multi Asset Scan
This guide walks you through creating a Multi Asset scan, a scan that combines several assets, such as mobile applications, web applications, network ranges, code repositories, and files, into a single scan with one shared set of settings and one consolidated report.
For background on how Multi Asset scanning works and when to use it, see Multi Asset Scan Profile. For the full list of assets you can add, see Supported Asset Types.
Create a Multi Asset Scan
Step 1: Select the Main Asset
- Click New Scan in the top bar.
- (Optional) Provide a descriptive title for your scan.
- Select the type of your main asset and configure it, then click Continue. For example, select PlayStore and search for the application.
Step 2: Add Your Assets
The Extra Context step is where you add the other assets of the scan. It is optional for a single-asset scan; add at least one asset here to run a Multi Asset scan.
-
Click Add asset.
-
In the Add Asset dialog, select the asset type. Use the All, Mobile, Web, Network, and Code tabs to filter the list. Mobile asset types are not listed when the main asset is a mobile application, because a scan can include at most one. Documentation adds documentation page URLs to help the agent understand your application.
-
Configure the asset, then click Add.
- Repeat for every asset you want to include in the scan.
Selecting Repository Archive lets you scan source code by uploading an archive, without connecting a Git provider or granting Ostorlab access to your repository.
Step 3: Select the Scan Profile
Once you have added an asset in Extra Context, the Multi Asset Deep Agentic Scan profile appears in the list. Select it. This is an AI-powered agentic scan that uncovers complex logical flaws, chains multiple vulnerabilities across multiple assets, and validates findings through proof-of-concept exploits.
Click Continue, then review the Guardrails: choose whether the AI agents run risky actions on their own or ask you first, and optionally set the vulnerability scope, blocked IPs and additional instructions. Click Continue.
Step 4: Select the AI Provider
Choose how the scan's AI analysis is powered:
- Cybermodels: run the scan using Cybermodels tokens, with no API key required. Your available balance is shown here, along with a Provision Tokens button.
- BYOK Simple or BYOK Advanced: run the scan using your own API key.
For more detail, see Generate a BYOK Scan Key and Cyber Models Overview.
Step 5: Choose the Effort Level
The effort level determines how deeply the scan analyzes your assets. Higher effort covers more risks but consumes more tokens.
| Effort | Tokens | Pentest Equivalent |
|---|---|---|
| Core | 50 | ~1 week |
| Advanced | 200 | ~2-4 weeks |
| Elite | 400 | ~4-8 weeks |
The pentest equivalent estimates the time one pentester needs to assess the risks covered by the selected effort level.
Effort levels that cost more than your available token balance are disabled, and the interface shows an Insufficient Balance message. Use Provision Tokens in the AI Provider step to add more.
Step 6: Configure the Optional Steps
The remaining steps are all optional. You can configure them or click Continue to skip.
Prompts
Add instructions to guide the scan behavior. See the AI Pentest Prompt Guide for guidance on writing effective prompts.
Test Credentials
Select predefined test credentials or add new ones to increase the coverage of the dynamic analysis. Credentials can also be managed from the Test Credentials menu.
Clicking Test Credentials shows the supported authentication types:
- Login & Password: authenticates with a username and password combination.
- Custom Credentials: key-value pairs matched semantically during testing.
- 2FA SMS, 2FA Email, 2FA TOTP, 2FA Manual: two-factor authentication handling. See 2FA for Authenticated Scans.
- Basic Authentication: the HTTP Basic Authentication scheme.
- Script: a custom Puppeteer script for complex authentication flows.
- Certificate: a TLS/SSL client certificate for mutual TLS.
- HTTP Headers: custom headers for authentication, commonly used by APIs.
Advanced Settings
Advanced Settings lets you:
- Limit the request rate (QPS).
- Set a Proxy.
- Whitelist URLs to scan with one regular expression per line.
Step 7: Start the Scan
Click Start scan in the panel on the right to start the scan. Once it completes, findings from every asset appear together in a single report, each with its severity, affected asset, and remediation guidance.
Example: a mobile app, its API and its code
This example scopes one scan around a banking application and the systems behind it. All names are placeholders:
- The Android application
com.example.bank, published on the Play Store. - The web API the application calls,
https://api.example.com. - The source code of the application and its backend, as a repository archive.
- An OpenAPI schema describing
https://api.example.com.
Select the application as the main asset in Step 1, and add the others in Step 2:
| Asset | Where to add it | What it adds |
|---|---|---|
com.example.bank (PlayStore) |
Main asset (Step 1) | The client to test. |
https://api.example.com (Web App) |
Web tab | The backend and APIs the app communicates with. |
| Source code (Repository Archive) | Code tab | The code of the app and its backend, from an uploaded archive. |
| OpenAPI schema (File) | Add Asset dialog | Supporting files, such as API schemas, scripts, and configs, that help the scan reflect how the system is actually built and deployed. |
To find the application in the store, search for it by its name or package name. If
it is only available in a specific country, select that country in the Country menu.
If the code is in a connected Git provider, add a Code Repository asset instead of the archive. This requires a configured source code integration; see Source Code Scanning.
Credentials. The credentials you select in Test Credentials apply to every asset in the scan.
In this example, add a Login & Password credential for a test account of the application, and an HTTP Headers
credential if https://api.example.com expects an API key header. See also
Authenticated Web Application Scan.
Scope. The scope is the set of assets you add: at least one, and at most one mobile application. To restrict which
URLs are tested, add the regular expression https://api\.example\.com in
Advanced Settings.
Context. The File asset carries the OpenAPI schema; add scripts and configs the same way. The
Repository Archive accepts .zip, .tar.gz, .tgz, or .7z archives. SBOM and lock files are not assets:
see Scans with SBOM or Lockfile. Use Prompts to focus the scan, for example with the API security
assessment template in the AI Pentest Prompt Guide.
Connected findings. Findings from the app, its API and its source code appear in the single report described in Step 7. The Multi Asset Deep Agentic Scan profile chains vulnerabilities across them, for example from the application to the API it calls, so a chain and the findings it connects stay in one report. See Multi Asset Scan Profile.
FAQ
How many assets can a Multi Asset scan include?
A scan can include at most one mobile application. Web applications, network ranges, code repositories, archives, and files can be added without a limit.
Do all assets share the same scan settings?
Yes. The scan profile, AI provider, effort, test credentials, and prompts are configured once for the scan and applied across every asset it contains.
Do I need to give Ostorlab access to my repository?
No. You can connect a Git provider if you prefer, but you can also add a Repository Archive asset and upload a
.zip, .tar.gz, .tgz, or .7z archive to scan the code without granting any access.
Why scan several assets together instead of separately?
Modern applications span mobile clients, web backends, infrastructure, and source code. Scanning them together lets the scan chain vulnerabilities across assets and keeps related findings in one report. See Multi Asset Scan Profile.