The scan page
Where a scan is, what it spent and what it changed, including the live AI pentest view.
Every scan has its own page: where it is, what it spent and what it changed. Open it from Scan History by clicking a scan's time or target, from a target's scan history on its product page, or from the Last scan strip on the Vulnerabilities page. Starting a scan from a scan form brings you here; when the scan is still waiting in the queue, Scan History opens instead. Previous scan of this target and Next scan of this target at the top step through the other scans of the same target.
Status and controls
Under the target, the header shows the product with its engagement, the status, when the scan started, how long it has run, and the LLM tokens it spent, with the cost once LLM prices are set. The cost reads ≥ $x when some of the models used have no price. The page updates itself while the scan runs.
- Reports: the state of the report (Pending, Generating, Partial, Complete or Failed), with the error underneath when it failed.
- Why a scan stopped: for an AI SAST scan that failed or was cancelled, the header says why. An AI Pentest scan shows its reason in the AI pentest card; AI DAST and the other scanners write theirs to the log.
| Button | What it does |
|---|---|
| Stop | Asks first, then stops a running scan. |
| Resume AI analysis | For an AI SAST scan that stopped part-way: continues from its last checkpoint. When it cannot, the stages panel says Cannot resume from a checkpoint: and the reason. |
| Download report | Downloads the report. While reports are still being written it reads Download partial report. |
| Recover reports | Shown for an Acunetix scan whose report generation failed: fetches the reports again. |
| Scan again with changes | Opens the scan form filled from this scan, to change something and run it. Not offered for a scan of an uploaded archive. |
| Back to History | Returns to Scan History, with the filters you left it with. |
Stop, Resume AI analysis, Recover reports and Scan again with changes are for operators and team admins.
AI analysis stages
An AI SAST scan shows where the AI analysis is: Git history, Architecture, Source analysis (with the files analyzed), Cross-file hunt (with the units traced), Validation (with the candidates checked), Advisory and Report. A stage switched off for the scan is marked off. See Run an AI Native SAST scan.
Following an AI pentest
A scan that ran AI Pentest shows the engagement live, in these cards:
| Card | What it shows |
|---|---|
| AI pentest | Where the engagement is: a sentence saying what is happening now, and the stages the engagement has passed. While it runs you may see Cycle N of M, Quiet for … (no log line and no tool running; the agent may be waiting on the model) or Waiting for a free worker since …. When it ends: Finished in … · and the reason (see How an engagement ends on the AI Pentest page). |
| Execution paths | The route each agent took, one station per plan step, with what each step found. The legend marks recon / enumerate, test, verify and report steps, partly done and planned steps, a tool that failed, a finding, a replan, and waiting for a worker. Below it the Step trail lists the steps of the selected agent; Jump to live returns to the newest. |
| Agents | One card per agent (several targets are tested by several agents). Select one to see only its findings, timeline and log. |
| Kill-chain coverage | Every service found, against the columns Fingerprint, Vuln scan, CVE match, Web test, Exploit and Findings. Each cell is done, running now, still to do, not reached or not applicable, so you see how far each service was tested. |
| Live findings | Proven findings, newest first, with who proved it and how, and a count per severity. Ruled out after verification lists issues the agent checked and dismissed. |
| Timeline | Where the time went, per agent: plan / analyze, recon tools, network scan, web testing, verify & record, waiting for a worker, no activity. Replay, or drag Show the state at, to see the whole page as it was at that moment; Live returns to now. |
The labels Plan, Execute, Analyze, Ideate, Replan, Credentials and Report that appear in these cards name what an agent was doing at the time. The log of an AI pentest can be shown Grouped by agent, step and tool, or as Lines, for All agents or the selected one.
What this scan changed
The Findings panel counts what the scan did to the vulnerability list:
| Count | Meaning |
|---|---|
| New | Findings reported for the first time. |
| Confirmed | Open findings the scan reported again. |
| Reopened | Resolved findings the scan found again. |
| Auto-closed | Findings closed because the scan showed the defect is gone. |
Click a count, or View findings, to open the Vulnerabilities page filtered to this scan. Some engines write their findings only to the report; for those the panel says so.
Configuration and spend
- Targets: the scope submitted for the scan. With more than five, Show More lists the rest.
- Scanners: the engines it used.
- Parameters: its settings, such as the scanning mode, the main language, the product, the repository and the revision (branch @ commit) that was scanned.
- LLM Tokens: prompt, completion and total tokens, and the number of LLM calls.
- AI models used: for each AI task of the scan (Task), the Model that answered it, its Requests and Tokens. Which model handles which task is set in AI providers and cost.
Log output
The log streams as the scan runs. Filter it by level (All levels, Warnings and errors or Errors only) and by scanner (the list shows the scanners that wrote to the log); the summary says how many entries are shown. Copy it with the button beside the filters. Warnings such as Scanner skipped or an unreachable target are explained in Scan outcomes.
For AI scans the log names the stage the scan is in, so you can tell a slow scan from a stuck one.
In ScanSuite Teams, a scan of an archive uploaded from CI also shows the repository, branch and commit the archive was made from.
Last reviewed 2026-10-19