Platform

Platform overview How it works Authorization testing Evidence & reports Private scanning Integrations

Solutions

Security agencies Product teams Regulated industries Partner programme

Learn

Blog Knowledge hub Compare

Resources

Pricing Documentation Help centre FAQ Security & data What we haven’t proved

Company

About Contact Careers Sign in to the platform Start a $199 pilot →

Home / Help centre / Running scans

Running scans

How do I start a scan?

Quick answer

Click the Scan button on a profile row in Scan Profiles or on a target's page, or on a target row in Targets. The scan starts at once and keeps running if you leave the page. Follow it from Recent Scans.

Steps

A scan is one run of a scan profile. You need a target first, then a profile for it.

  1. Make sure a profile exists. The target needs a scan profile. Create one under Scan Profiles with + New profile.
  2. Click Scan. Press the green ▷ Scan button on the profile row.
  3. Leave or stay. The run is durable, so you can close the page.
  4. Go to Recent Scans. Click the new row to open the scan detail page.
  5. Wait for the result. Each run ends as Completed, Failed or Cancelled.

Good to know

A white-box target must have a Git repository over HTTPS. Without one the page shows No repository configured — add a Git repository URL to run a scan. A black-box target needs verified ownership before it can run.

You can start the same run from three places: the Scan Profiles list, a target's page, or the Targets list. Nothing extra pops up in the capture we reviewed, so the run begins straight away. A typical scan of a small app takes roughly an hour.

Only scan applications you own or have written permission to test.

If it does not start

Read the note on the target page first. A white-box target without a repository cannot run, and a black-box target needs verified ownership before its first run. If a new scan does not begin at once, see why a new scan will not start at once, because scans at once are limited by your plan.

Only scan applications you own or have written permission to test. That rule holds for every target you add, whether it is a staging site, a private app or a public one, and black-box targets enforce it with the ownership check. Keep it simple.

Full tutorial

How to run a pentest scan in Cyberlop, and what happens next

Step-by-step, with annotated screenshots.

Updated · Back to the help centre

Still stuck?

Tell us what you see on screen and an engineer will help you sort it out.