How do I choose which vulnerability classes a profile tests?

Steps

1. Open the profile. Start a new profile, or open an existing one with the pencil icon on Scan Profiles.
2. Find the classes. On the Scope section, scroll to Vulnerability classes. Ten checkboxes sit there.
3. Tick what you need. Select the classes that matter for this run. Untick any you do not want.
4. Leave it empty for everything. The help text says "Leave empty to scan all classes." Tick nothing to test all ten.
5. Save. Click Save. The Scan Profiles table lists your classes, or shows All.

Good to know

What the classes cover

Injection covers SQL, command and template injection. Xss covers reflected, stored and DOM scripting flaws. Auth looks at logins, sessions and tokens, while Authz looks at access control, such as one account reaching another's data. Ssrf, Crypto and Config cover server-side requests, weak keys and risky settings. Business-logic covers flaws in how the app's own rules work, such as steps that can be skipped. Dependency and Secrets round out the list.

A narrow profile suits a narrow question, such as a check of the login after a change, and it keeps the report short. A full profile gives the widest view of the app, which suits a first scan or a regular audit. Many teams keep both, as in several profiles per target.

Not sure what to pick? Start with all classes, then narrow later. Questions go to /contact.

Related questions

• How do I make a profile test all vulnerability classes?
• Which vulnerability classes can Cyberlop test for?
• What kinds of injection does the Injection class cover?
• What's the difference between the Auth and Authz classes?
• Why does the profiles list show "All" under Vuln classes?

Full tutorial

Choose vulnerability classes in a Cyberlop scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre