How do I create a scan profile?

Steps

1. Start a new profile. Click Scan Profiles then + New profile. Or open a target and use + New profile there, which picks the target for you.
2. Fill in the basics. Choose the target, type a name, and add tags if you want them.
3. Choose the scope. Tick the vulnerability classes to test, keep or untick Run exploitation phase, and pick the scan location. Add Focus or Avoid rules if needed.
4. Add roles if the app has a login. Open Authentication, click + Add role, and set the privilege level and method.
5. Shape the report. Open Reporting and choose a minimum severity and confidence. Add guidance, rules of engagement and application context if useful.
6. Check and save. Click Preview YAML to validate the form, then click Save.

Good to know

A profile is a reusable scan setup that belongs to one target, and it holds everything about how that target is tested: what to look for, how to sign in, and what the report should include. You cannot change its target after creation, so pick carefully. You can make several profiles for the same target, such as a quick one for each release and a full audit once a quarter. Each one keeps its own scope, roles and report rules, so changing one never disturbs the others.

Leave the vulnerability classes empty to test them all. Leave Authentication empty to scan without a login.

After saving, press ▷ Scan on the profile row. A small app usually takes about an hour. Stuck on a field? Write to /contact.

Related questions

• What is a scan profile?
• How do I edit an existing scan profile?
• Can I have more than one scan profile for the same target?
• How do I preview the YAML config a profile generates?
• How do I create a profile that's already set to a specific target?

Full tutorial

How to create a scan profile in Cyberlop: Scope, Authentication, Reporting

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre