# Introduction

> What ScanSuite is, what it scans, and how the platform fits together.

Source: https://scansuite.eu/documentation/introduction
Last reviewed: 2026-10-19

ScanSuite is a security scanning orchestration platform. It takes the things you already have — a repository, a running web application, a range of hosts, a container image — and runs security analysis against them, on self-hosted infrastructure.

Two kinds of engine work side by side. **AI agents** plan their own work, call tools, and verify what they find against the real system before reporting it. **Classic scanners** — dozens of open-source and commercial engines — run in parallel in isolated containers. You choose per scan which ones run; the scan forms start with the AI scanners selected, so an AI provider is part of every installation (see [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers)).

## What you can point it at

- Source code archives
- Code repositories, including monitored branches that scan on change
- Web application and API URLs
- Host names, IP addresses and domains
- Container image names

ScanSuite selects the appropriate scanners through pre-configured connectors and invokes them with parameters tuned for the target, rather than asking you to assemble a scan profile yourself.

## What comes back

Findings are normalised into a single vulnerability record, deduplicated within the scan and against history, and managed in ScanSuite's own [Vulnerabilities section](https://scansuite.eu/documentation/usage/vulnerability-management) — triaged, assigned an owner and due date, tracked to closure and proven with a runnable exploit, all without leaving the platform. Raw scanner reports and structured parsed results are both available for download.

Everything the AI scans find is managed in Vulnerabilities. Most classic scanners can store their findings there too; their full results also go to DefectDojo when a team connects one — which scanners do what is on [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo).

Teams that track remediation in **ServiceNow** are served differently, and deliberately so: ScanSuite exports a ServiceNow-shaped spreadsheet, and the statuses the ServiceNow workflow sets come back the same way. There is no direct connection, no stored credentials and no outbound calls — the exchange is files, on local terms. See [Rescans and fix verification](https://scansuite.eu/documentation/usage/vulnerability-management/rescans-and-fix-verification).

> **Note:** Everything runs inside the perimeter. ScanSuite can be deployed on-premises, in a private cloud, or fully offline with an AI model served inside your network — source code and findings stay where they are put.

## How you reach it

| Way in | What it is for |
|---|---|
| The web console | Everything: products, scans, findings, team and installation settings. Served by the installation itself over HTTPS. |
| The REST API, with API tokens | Products, scans, findings and assets from your own scripts. A team admin creates the token; see [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles). |
| The scansuite-ci pipeline client | Starts scans from a CI/CD pipeline, waits for them and fails the build on what they find; see [CI/CD and automation](https://scansuite.eu/documentation/reference/cicd). |
| AI coding agents | Claude Code and similar agents run scans and read results through the ScanSuite skill; see [Working with AI agents](https://scansuite.eu/documentation/reference/agent-skill). |

> **Agent prompt: Ask your AI assistant what ScanSuite can do**
>
> ```text
> Read https://scansuite.eu/documentation/llms.txt and tell me whether ScanSuite can scan <our stack> and which scan types and integrations it would use. Quote the documentation page for each answer.
> ```

Every documentation page also has a **Copy for AI** button, which copies the page as text to paste into any assistant.

## Two editions

| Edition | What it gives you |
|---|---|
| ScanSuite | One installation, shared by everyone who signs in. Users and settings are administered in one place. |
| ScanSuite Teams | Everything above, plus teams. Each team has its own products, scans, findings, assets, credentials and settings, and people hold a role in each team they belong to. It also adds installation administration at /admin, single sign-on, API tokens for automation, and the pipeline build gate. |

This documentation describes **ScanSuite Teams**. Chapters that describe a Teams feature are marked **Teams** in the sidebar and say so before the first heading. Your licence decides which edition you have; on a server, the first line of `./scansuite version` in `/opt/scansuite` names it.

## Start here

New to ScanSuite? [Quick start](https://scansuite.eu/documentation/quick-start) takes you from a fresh server to the report of your first scan. [Architecture](https://scansuite.eu/documentation/architecture) is background for whoever plans the server and its network.

- [Quick start](https://scansuite.eu/documentation/quick-start): From a fresh server to the report of your first scan: install, sign in, connect AI, create a product, scan.
- [Installation](https://scansuite.eu/documentation/installation): Everything needed to get a ScanSuite Teams server running.
- [Architecture](https://scansuite.eu/documentation/architecture): The services a ScanSuite installation runs, and the deployment models.