How an assessment runs

An assessment runs in up to two phases. Discovery always runs. Confirmation is available on self-hosted deployments.

Phase 1: discovery

Discovery maps your exposure and surfaces weaknesses. It works across a target in stages, building on what it learns: it discovers assets, enriches them with service and version detail, checks them for vulnerabilities, audits them against common compliance baselines, and writes up what it found.

The output is a set of candidate findings, ranked by risk, each backed by evidence. Candidate means detected but not yet proven.

The managed cloud runs discovery against domains you have verified you own. That keeps assessments limited to systems you control.

Phase 2: confirmation (self-hosted)

Confirmation takes the candidate findings from a completed discovery run and safely proves which of them are genuinely exploitable. When it proves one, it attaches proof-of-concept evidence and upgrades the original finding to confirmed. This is the difference between “a scanner flagged this” and “here is what an attacker could actually do”.

Confirmation is safe by design. It demonstrates impact as proof of concept only. It does not run destructive payloads, exfiltrate data beyond what proves the point, leave anything behind, or move beyond the target. See Safe exploitation for the full envelope.

Confirmation runs on self-hosted deployments, where the work stays inside your own environment.

Following a run

You can watch a run live as each step happens, or leave it and come back to the results. Either way the outcome is the same: findings you can open, evidence you can inspect, and a report you can share.

Next

• Running an assessment: launch and follow a run.
• Findings and reports: read and export results.
• Confirming findings: the confirmation phase in practice.