# Using ScanSuite

> Everything you can do with a running ScanSuite deployment, by task.

Source: https://scansuite.eu/documentation/usage
Last reviewed: 2026-10-19

Everything below assumes a working installation. If you have not got one yet, start with [Installation](https://scansuite.eu/documentation/installation). New here? [Quick start](https://scansuite.eu/documentation/quick-start) takes you from a fresh server to the report of your first scan.

## Before the first scan

- **Create a product.** Every scan result and every discovered asset is filed under one. See [Products](https://scansuite.eu/documentation/usage/products).
- **Make sure your team has AI.** The scan forms start with the AI scanners selected. On the Teams page, AI tab, the AI provider must be the system AI or the team's own models; without it, switch the AI options off on the scan forms. See [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers).

## Run scans

- [Static Code Analysis](https://scansuite.eu/documentation/usage/static-code-analysis): Analyse a repository or an archive: AI Native SAST, secrets, dependencies and the classic scanners.
- [Web App Scanning](https://scansuite.eu/documentation/usage/web-app-scanning): Scan websites and web APIs, signed in or not, with classic scanners, AI DAST or the AI Pentest agent; the target rules for every scan.
- [AI Pentest](https://scansuite.eu/documentation/usage/ai-pentest): An autonomous penetration test of web applications and hosts that reports only what it proved.
- [Infrastructure Checks](https://scansuite.eu/documentation/usage/infrastructure-checks): Vulnerability scans, network discovery, patching checks, domain OSINT and container images, with the AI Pentest agent as the default.
- [Schedule the scan](https://scansuite.eu/documentation/usage/schedule-the-scan): Schedule web, infrastructure and static scans, manage them on the Schedules page, or schedule from your CI system.
- [Managing scan execution](https://scansuite.eu/documentation/usage/managing-scan-execution): Scan History: filtering, rerunning, stopping, downloading reports, exporting to CSV, and what each scan outcome means.

## Work with results

- [Products](https://scansuite.eu/documentation/usage/products): Create, rename and delete products, and see every product ranked by open risk with what needs attention first.
- [Vulnerability Management](https://scansuite.eu/documentation/usage/vulnerability-management): Read, triage, assign and suppress findings: one record per issue, tracked through its history and closed on evidence.
- [Classic scanner results in DefectDojo](https://scansuite.eu/documentation/usage/working-with-scan-results): Reading and exporting the classic scanners' findings in DefectDojo.
- [Reports and exports](https://scansuite.eu/documentation/usage/reports-and-exports): Every report and export with its options and scope, DefectDojo, Securitm and importing external reports.
- [Exploitable Vulnerabilities Database](https://scansuite.eu/documentation/usage/vulnerability-database): The local database of CVEs with exploitation evidence: check a product version, filter, and read a CVE.
- [Global search and activity log](https://scansuite.eu/documentation/usage/global-search): Finding anything across assets, vulnerabilities, scans and credentials.

## Configure scanning

- [Credentials](https://scansuite.eu/documentation/usage/credentials): Secrets and leaked credentials found by scans, your own pairs for the AI scans' login audit, and checking whether they still work.
- [Assets](https://scansuite.eu/documentation/usage/assets): The hosts your scans found, with their open findings, ports, technologies and scans; filters, saved views, bulk actions, and deletion that lasts and can be undone.
- [Custom Rules](https://scansuite.eu/documentation/usage/custom-rules): Your own Semgrep and Nuclei rules: editor, tests, AI drafts, import and Git sync, plus the suppression rules and suppressed names triage creates.
- [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers): Connect AI models, route each AI task to a model for the system or one team, keep code on-premise, and track AI cost.