How do I make a profile run on a self-hosted scan agent instead of the cloud?

Steps

1. Add and start an agent. In Settings → Scan Agents, add an agent, copy its one-time token and run the command inside your network. Wait until it shows online.
2. Find the profile. Go to Scan Profiles and click the pencil icon on the row, or start a new profile.
3. Change the location. On the Scope section, open the Scan location list and choose your agent.
4. Save. Click Save.
5. Run the scan. Press ▷ Scan. The scan runs on the agent and looks the same in the app as a cloud scan.

Good to know

Choose an agent when the app sits on a private network that the Cyberlop cloud cannot reach. The agent connects outward over HTTPS only, so you open no inbound ports, and your code stays on your network. That makes it a good fit for internal staging apps, or for a repository behind a VPN.

Once the profile points at an agent, every scan launched from it, whether by hand, on a schedule or from your pipeline, goes to that agent.

If the agent shows offline, a scan cannot start until it is back online. An online agent also raises your concurrent scan limit. If you revoke an agent, its profiles go back to the Cyberlop cloud.

Agent missing from the list? Read why an agent is missing from Scan location. Setup steps are in the self-hosted scan agents guide. For help, use /contact.

Related questions

• Why doesn't my scan agent appear in the Scan location list?
• Why won't a profile set to my scan agent start a scan?
• I removed a scan agent. Where do my profiles' scans run now?
• Why is my scan agent stuck on pending?
• My app is only reachable inside our network, so cloud scans can't reach it. What do I do?

Full tutorial

Cyberlop self-hosted scan agents: scan private apps from inside your network

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre