Can I give someone access to only some of our targets?

The short version

Yes, you can. Access in Cyberlop has two parts. A role says what a person may do, such as run scans or triage issues. A group says where they may do it.

How it works in Cyberlop

The Security page describes role-based permissions with grants scoped to groups. The API Reference describes groups as the tool for "access-control scoping". It also describes teams with scoped grants.

A group holds scan profiles, and every profile belongs to one target. So a group of profiles is a group of targets in practice. Someone scoped to that group reaches only those profiles and the scans and findings that come from them.

The same scope follows API tokens. A scan started from a pipeline runs with the token owner's permissions and group scope, so a limited person gets a limited token.

What to do next

1. Create a group on the Groups page and add the profiles for the targets this person needs.
2. Pick a role that carries only the keys they need. Read which permissions a custom role can hold for the list.
3. Ask an admin to tie the grant to the group in Administration.

We did not capture the Administration screens, so the exact buttons are in the app. If you get stuck, ask us on the contact page. After the change, ask the person to confirm they see only what you meant, and check why some targets are missing if a list looks short. This is least privilege in practice.

Related questions

• What are groups used for?
• How do I create a group of scan profiles?
• How do I create a custom role with specific permissions?
• Why can't I see some targets that my colleague can see?
• How do I see each user's role and team grants?

Full tutorial

How to group scan profiles by tag and group in Cyberlop

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre