Web Deep Agentic Scan

The Web Deep Agentic Scan is AI-powered penetration testing for your web applications. It:

• uncovers complex logical flaws and chains vulnerabilities into attack paths;
• validates findings with proof-of-concept exploits to confirm their real-world impact;
• prioritizes risks by how the weaknesses relate to each other.

How do I create a Web Deep Agentic Scan?

1. Click "New Scan" in the top bar.

   

2. Select either "Web App" or "Web API". For this example, we will select "Web App".

   

3. Specify the target URLs / domains, each on a separate line. Click "Continue".

   

4. The "Extra Context" step is optional: click "Continue" to skip it.

5. Select "Web Deep Agentic Scan" as the scan profile and click "Continue".

   

6. Review the "Guardrails". The scan runs within the approved scope and excludes the environments you specify.

   • "Approval of actions" (Approve the actions of an AI agent): what the AI agents do before a risky action, such as sending an SMS or publishing a file:
     • "Run without asking": they run it on their own.
     • "Ask me, block if no answer": they ask you first, and skip the action if nobody answers.
     • "Ask me, run if no answer": they ask you first, and run the action if nobody answers.
   • "Vulnerability scope" (optional): the domains and IPs the agent tests and reports vulnerabilities on. Leave it empty to report on every target.
   • "Blocked IPs" (optional): IPs and CIDR ranges the agent never reaches.
   • "Additional instructions" (optional): testing boundaries, environments to avoid or other safety requirements.

   Click "Continue".

   

7. Select the AI provider: "Cybermodels" runs the scan on Cybermodels tokens, so there is no API key to manage, while "BYOK Simple" and "BYOK Advanced" use your own API key. See Cyber Models and Use your BYOK Scan Key in a Scan Profile. Click "Continue".

   

8. Set the "Effort": the exploration depth and the number of tokens allocated to the scan. Each level is compared to a manual pentest, meaning the time one pentester needs to assess the same number of risks:

   • "Core": about 1 week of pentest.
   • "Advanced": about 2 to 4 weeks of pentest.
   • "Elite": about 4 to 8 weeks of pentest.
   • "Custom Tokens": a token budget you set yourself.

   Click "Estimate this scan" to get a token estimate and an effort recommendation for your target. Click "Continue".

   

9. Configure the optional steps as needed:

   • Test Credentials: enable authenticated testing.
   • SBOM or lock files: extend dependency detection.
   • Prompts: guide the Web Deep Agentic Scan on what to test.
   • Advanced Settings: set request rate (QPS), a Proxy, or a Filter URL regex to exclude URLs from crawling and scanning.
   • Tags: label the scan for organization.

10. Click "Start scan" in the panel on the right.

    

What do the scan results show?

1. Follow the scan from "Scans" in the top bar, and open it when it is done.

   

2. "Risks" lists every attack path the agents tested, with its risk rating and status.

   

   Open a risk to explore its Transparent Attack Validation path: the exact decisions, tool outputs, and steps taken by the AI agent to validate vulnerabilities.

   

3. Open the Scan Coverage Heatmap, which provides a visual view of testing coverage across application components and security categories. This helps teams understand which areas of the application received deeper analysis, where coverage was limited, and how coverage evolves across assessments.

   

   Note: Historical Scan Processing is enabled by default. The scanner remembers previous findings and validated attack paths, focusing subsequent scans on new or changed functionality for cumulative, incremental coverage.

Next: Approve the actions of an AI agent or guide the scan with prompts.