Why aren't any of my findings marked Confirmed?

Why this happens

Proof comes from the fourth phase of a scan. For each hypothesis, an exploitation agent tries to demonstrate the issue safely against the live target, using a real browser. It captures the request, the response, the payload and, where it helps, a screenshot. Each finding then gets a grade of Confirmed, Likely or Unconfirmed, depending on how strongly the agent proved the issue.

So Confirmed needs that phase to run and to succeed. It can fail to do so for three reasons:

• The phase was off. The tooltip on the checkbox says that leaving it clear means "SAST only", which is static source-code analysis with no live testing.
• The agents could not sign in. Without a working role, they only reach public pages.
• The app was out of reach. A cloud scan cannot open an internal URL.

How to fix it

1. Go to Scan Profiles and click the pencil icon on the profile you used.
2. On Scope, tick Run exploitation phase. It is on by default, so someone may have cleared it.
3. On Authentication, check that a role exists if the app needs a login. Use Complete authentication to test an OAuth 2.0 role.
4. Check Scan location. For an app on a private network, which the Cyberlop cloud cannot reach, choose a self-hosted scan agent that sits inside that network.
5. Click Save, then Scan. Open the new findings and read the Status field.

Still not working?

Some findings stay Likely even after a full run. A flaw can be real and still be hard to demonstrate safely on a live system, so the agent stops short of forcing it. Read the Evidence tab to see what the agent did try. Static-only findings are still useful. They point to a file and line, which gives your developers a place to start even before anything has been proven live. Our page on the exploitation phase has more, and the status values explain each grade. Profile looks right and still nothing is Confirmed? Contact us. The exploitation phase tutorial goes deeper.

Related questions

• What's the difference between Confirmed, Likely and Unconfirmed?
• What does the exploitation phase do?
• How do I turn off the exploitation phase?
• Why is the exploitation phase turned on in my new profile when I didn't tick it?
• My app is only reachable inside our network, so cloud scans can't reach it. What do I do?

Full tutorial

The exploitation phase: on or off, and safe in production

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre