Pentestas / help

Scan modes

Every web and API scan picks an engine mode. The mode decides how much of the work is deterministic modules versus Claude-driven investigation.

UI label Engine value AI calls Best for
Internal Engine heuristic None Fast deterministic coverage, offline/air-gapped, cost-sensitive runs
+ AI assist hybrid Targeted Default paid-tier posture — full module coverage + AI on high-value leads
Autonomous (experimental) autonomous Heavy Claude drives most of the engagement end-to-end

Set the mode on New scan → Advanced → Scan Mode (web) or the equivalent control on API scans.

Internal Engine (heuristic)

Runs the full parallel module pipeline: crawl, fingerprint, 70+ detectors, Accuracy Gate verifiers, reports. No LLM traffic.

  • Deterministic and repeatable.
  • Always available (no Anthropic key required).
  • Operator manual tools still work after the scan for hands-on follow-up.
  • Operator hints can still steer focus/skip/retest paths when the engine is running, but there is no workbench-agent phase.

Use when you want maximum speed-to-findings without AI cost, or when policy forbids sending traffic metadata to a model.

Hybrid is the production AI pentester mode:

  1. Full heuristic pipeline — same coverage as Internal Engine (modules, crawl, verifiers).
  2. AI analysis — narratives, false-positive filtering, attack-chain synthesis (Pro+).
  3. Workbench agent phase — after modules finish (and when HIGH/CRITICAL leads exist), Claude investigates using the same tools as the scan-screen console: HTTP History, Site map, Forge (Repeater), Volley (Intruder), OAST, plus multi-surface pivots. See AI workbench.

Claude is not spraying every module again. It reads real captured traffic, mutates requests, ranks Intruder hits, and only reports what it can prove.

Autonomous (autonomous) — experimental

Claude drives recon → attack selection → tool use → chaining with less reliance on the fixed module schedule. Higher token cost, longer runtimes, and more variance between runs. Prefer hybrid for day-to-day work unless you explicitly want an agent-led engagement.

What each mode does not change

  • Scope and authentication still come from the scan config.
  • Accuracy Gate + proof status still classify every finding.
  • Manual tabs (HTTP history, Forge, Volley, OAST, …) remain available on the scan detail page for human operators.
  • Agent-relayed scans still proxy tool traffic through your local agent.

Choosing a mode

Situation Mode
Staging smoke test, no AI budget Internal Engine
Production / customer-facing pentest with AI narrative + deep dives + AI assist
Research engagement, "let the agent hunt" Autonomous (experimental)
Cloud-only target (Azure SP / AWS keys) Use the cloud scan / Azure family — mode above is for web/API engines

See also