Untick the box labelled Run exploitation phase on the Scope section of the profile, then click Save. The scan then does static source-code analysis only (SAST) and makes no live tests against your running app.
Steps
- Open the profile. Edit an existing profile with the pencil icon, or start a new one.
- Find the checkbox. On the Scope section, look below the vulnerability classes for Run exploitation phase. The box starts ticked.
- Untick it. Click the box so the tick disappears. Hover over the small question mark for the built-in explanation.
- Save. Click Save. The profile row now shows exploitation as off.
Good to know
With the box ticked, a scan runs a DAST pass. Agents make real HTTP requests, drive a browser and capture evidence to prove each finding. With it unticked, you get static analysis of the source code and no live testing at all.
Turn it off when you only want a code review, for instance when the app is not reachable from the cloud or when you do not want any live traffic at all. Remember that a scan with exploitation off finishes its job without browser proof, so read its findings with that in mind. Nothing is tried against the running app, so a code review on its own cannot show that a weakness really works in practice, which is why some teams run both kinds of profile.
You can keep two profiles for one target, one with exploitation and one without, and choose per run. Read what the exploitation phase does for the detail. To switch it back on, tick the box again and save. Help is at /contact.
Related questions
- What does the exploitation phase do?
- Why is the exploitation phase turned on in my new profile when I didn't tick it?
- How do I create a scan profile?
- How do I edit an existing scan profile?
- What are the five phases of a Cyberlop scan?
The exploitation phase: on or off, and safe in production
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.