ScanSuite's AI agents review your code, attack your web applications and test your infrastructure, then report only what they can back up: the call path, the exact request, or an exploit that runs. Self-hosted, so your code stays with you.
The documentation is written for people and for agents. Paste one of these into Claude Code, ChatGPT or any coding agent.
Read https://scansuite.eu/documentation/llms.txt and tell me whether ScanSuite can scan our stack (<describe it>) and what it would find.Install ScanSuite Teams on this server by following https://scansuite.eu/documentation/installation/install-scansuite-server. Stop and ask me whenever a step needs a licence, a password or a DNS change.Set up ScanSuite for me: fetch and follow https://scansuite.eu/documentation/agent-setup.mdThe expensive part of application security is not finding candidates. It is deciding which of them are real. ScanSuite moves that work to the agents and shows you how they decided.
Run them separately or together against the same checkout, URL or network range. Everything they report lands in one deduplicated vulnerability record.
Reads the code the way a reviewer does, so it finds broken authorization and business-logic flaws that no rule describes.
Cuts a dependency scan down to the advisories that have been exploited and that your code actually reaches.
A web scanner that chooses the technique and writes the payload for each endpoint, then reproduces the result before it reports.
An agent that plans an engagement, runs the tools, revises the plan on what it learns, and reports what it demonstrated.
Gitleaks, TruffleHog and Nosey Parker results checked by the model; leaked logins can be tested live.
Network discovery with change alerts, patch checks over SSH or WMI, and domain OSINT including leaked credentials.
Semgrep, Snyk, Trivy, KICS, Nuclei, Nessus, Acunetix and more, run in parallel in isolated containers.
Screens from the product, unedited. Click one to see it full size.
There is no scan profile to tune. Give the agent a scope and, if you like, priorities, and it runs the engagement on its own while you watch.
A finished engagement against a public test site: every plan step, the tools it ran and what it found.
Name the targets and what matters to you. Nothing else to configure.
Follow every step live on the scan page, with the execution paths of each agent. The scanners you already license are used where they help.
The engagement adapts to what the target turns out to be, rather than running a fixed checklist.
Reports only what it demonstrated, with attack chains where one weakness led to another, in Markdown and XLSX.
The agent only touches the targets you allowed. Anything outside them is refused before it is sent.
The agent works through vetted tools only. It never gets a shell on your systems.
Proofs of concept the agent writes run in an isolated sandbox.
Every engagement runs within a budget that guards against runaway cost, and stops once coverage is reached.
Findings from every engine and every classic scanner follow the same path. A finding is closed when a rescan shows it is gone, and reopens if it comes back.
One record per issue, however many tools report it.
Every decision needs a reason. False positives can become suppression rules.
An owner and a due date set by severity, with overdue counts.
A deep link to the line, the suggested fix and the evidence.
A targeted rescan closes it on evidence, or reopens it.
A defensible answer to "how exposed are we, and is it improving?"
A ticket that makes the case for itself.
Both editions include every scanning engine. Teams adds what an organisation with several teams needs, and an existing installation upgrades in one run.
One shared installation for a security team.
For organisations where several teams share one platform.
Not with a local model: the platform, the exploit database and the model all run inside your perimeter. With a hosted provider, code is sent only to the provider you configure, under your own account.
Scope is enforced in code, the agent only calls allow-listed tools, exploits run sandboxed, and every engagement has a budget. We still recommend starting against staging.
Keep them. ScanSuite runs them, deduplicates their output with the AI engines, and the pentest agent can drive Nessus, OpenVAS and Acunetix directly.
Spend is recorded per scan and shown in money. Incremental scans re-analyse only changed files, and in Teams each team can have a monthly budget.
AI findings can be verified before they are reported. What remains is triaged with a required reason, a false positive can become a suppression rule, and a closed issue that returns reopens its original record.
Scan scripts run from any CI system. Teams adds a build gate with SARIF and JUnit output. Findings flow to DefectDojo and from there to Jira, or to ServiceNow by XLSX exchange.
A Docker host with 4 CPU, 16 GB RAM and 100 GB of disk handles 3–4 parallel scans. Installation and upgrades are one command, online or offline.
Any OpenAI-compatible endpoint, Claude on Vertex AI, or local models through Ollama or LM Studio. For local use we recommend models of 30B parameters or more.
A working session on real findings, not a slide deck.