Why is the exploitation phase turned on in my new profile when I didn't tick it?

Why this happens

The checkbox is on by default, so you did not tick it, the form did. The tooltip says the phase performs a DAST scan: the agents actively test and prove vulnerabilities against the live target, with real HTTP requests, a browser and captured evidence. Cyberlop grades each finding as confirmed, likely or unconfirmed, based on how strongly the agents proved it.

How to fix it

1. Go to Scan Profiles → + New profile, or edit a saved one.
2. On the Scope section, find Run exploitation phase.
3. Hover the question mark. It says ticked means a DAST scan, and unticked means SAST only.
4. Clear the box to skip live testing. The scan still reads your code.
5. Click Save. The target page then lists the profile with its Exploit setting.

Leave it on when you want evidence you can reproduce. Turn it off for a first look at the code, or where live testing is not allowed, and the scan skips that phase. With it off, the scan skips that phase and you get static analysis only.

Still not working?

Run live testing only against systems you have permission to test. Use Rules of engagement on the Reporting section, for example to avoid destructive payloads in production. The target page shows Exploit for each profile so you can check it later. Read how to turn the phase off, what the phase does and safe testing on production. Questions? Use the contact page.

Related questions

• How do I turn off the exploitation phase?
• What does the exploitation phase do?
• How do I keep testing safe on a production app?
• How do I add rules of engagement, such as no destructive payloads in production?
• How do I create a scan profile?

Full tutorial

The exploitation phase: on or off, and safe in production

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre