How do I make a profile test all vulnerability classes?

Steps

1. Open the profile. Choose + New profile, or use the pencil icon on an existing row in Scan Profiles.
2. Go to Vulnerability classes. On the Scope section, find the ten checkboxes, from Injection to Secrets.
3. Clear every box. Untick anything that is ticked. No box should have a mark.
4. Save. Click Save in the footer.
5. Confirm in the list. Back on Scan Profiles, the row's Vuln classes column reads All.

Good to know

Empty means everything here, which can feel backwards. The list column shows All only when no box is ticked, so an empty form is the clear way to say "test every class" and keep the profile easy to read at a glance.

The ten classes are Injection, Xss, Auth, Authz, Ssrf, Crypto, Config, Business-logic, Dependency and Secrets. Any class you leave out of a narrower profile gets no testing in that run, so an empty form is the safer default when you are unsure.

Testing every class takes longer than testing a few, so a full run on a large app can take more than the hour a small app needs. Use a narrower profile for quick checks after a change, and keep one full profile for regular audits.

If a profile shows a short list when you wanted All, edit it and clear the boxes. Read why the list shows All for more. Other questions go to /contact.

Related questions

• How do I choose which vulnerability classes a profile tests?
• Why does the profiles list show "All" under Vuln classes?
• Which vulnerability classes can Cyberlop test for?
• How do I create a scan profile?
• How do I edit an existing scan profile?

Full tutorial

Choose vulnerability classes in a Cyberlop scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre