Using ScanSuite
Everything you can do with a running ScanSuite deployment, by task.
Everything below assumes a working installation. If you have not got one yet, start with Installation. New here? Quick start takes you from a fresh server to the report of your first scan.
Before the first scan
- Create a product. Every scan result and every discovered asset is filed under one. See Products.
- Make sure your team has AI. The scan forms start with the AI scanners selected. On the Teams page, AI tab, the AI provider must be the system AI or the team's own models; without it, switch the AI options off on the scan forms. See AI providers and cost.
Run scans
Static Code Analysis
Analyse a repository or an archive: AI Native SAST, secrets, dependencies and the classic scanners.
Web App Scanning
Scan websites and web APIs, signed in or not, with classic scanners, AI DAST or the AI Pentest agent; the target rules for every scan.
AI Pentest
An autonomous penetration test of web applications and hosts that reports only what it proved.
Infrastructure Checks
Vulnerability scans, network discovery, patching checks, domain OSINT and container images, with the AI Pentest agent as the default.
Schedule the scan
Schedule web, infrastructure and static scans, manage them on the Schedules page, or schedule from your CI system.
Managing scan execution
Scan History: filtering, rerunning, stopping, downloading reports, exporting to CSV, and what each scan outcome means.
Work with results
Products
Create, rename and delete products, and see every product ranked by open risk with what needs attention first.
Vulnerability Management
Read, triage, assign and suppress findings: one record per issue, tracked through its history and closed on evidence.
Classic scanner results in DefectDojo
Reading and exporting the classic scanners' findings in DefectDojo.
Reports and exports
Every report and export with its options and scope, DefectDojo, Securitm and importing external reports.
Exploitable Vulnerabilities Database
The local database of CVEs with exploitation evidence: check a product version, filter, and read a CVE.
Global search and activity log
Finding anything across assets, vulnerabilities, scans and credentials.
Configure scanning
Credentials
Secrets and leaked credentials found by scans, your own pairs for the AI scans' login audit, and checking whether they still work.
Assets
The hosts your scans found, with their open findings, ports, technologies and scans; filters, saved views, bulk actions, and deletion that lasts and can be undone.
Custom Rules
Your own Semgrep and Nuclei rules: editor, tests, AI drafts, import and Git sync, plus the suppression rules and suppressed names triage creates.
AI providers and cost
Connect AI models, route each AI task to a model for the system or one team, keep code on-premise, and track AI cost.
Last reviewed 2026-10-19