Pentestas / help

Scan modes

Every web and API scan picks an engine mode. The mode decides how much of the work is deterministic modules versus Claude-driven investigation.

UI label Engine value AI calls Best for
Internal Engine heuristic None Fast deterministic coverage, offline/air-gapped, cost-sensitive runs
+ AI assist hybrid Targeted Default paid-tier posture — full module coverage + AI on high-value leads
AI investigation investigation Planner and workers Goal-driven exploration with an evidence graph and recorded execution history

Set the mode on New scan → Advanced → Scan Mode (web) or the equivalent control on API scans.

Internal Engine (heuristic)

Runs the full parallel module pipeline: crawl, fingerprint, 70+ detectors, Accuracy Gate verifiers, reports. No LLM traffic.

  • Deterministic and repeatable.
  • Always available (no Anthropic key required).
  • Operator manual tools still work after the scan for hands-on follow-up.
  • Operator hints can still steer focus/skip/retest paths when the engine is running, but there is no workbench-agent phase.

Use when you want maximum speed-to-findings without AI cost, or when policy forbids sending traffic metadata to a model.

Hybrid is the production AI pentester mode:

  1. Full heuristic pipeline — same coverage as Internal Engine (modules, crawl, verifiers).
  2. AI analysis — narratives, false-positive filtering, attack-chain synthesis (Pro+).
  3. Workbench agent phase — after modules finish (and when HIGH/CRITICAL leads exist), Claude investigates using the same tools as the scan-screen console: HTTP History, Site map, Forge (Repeater), Volley (Intruder), OAST, plus multi-surface pivots. See AI workbench.

Claude is not spraying every module again. It reads real captured traffic, mutates requests, ranks Intruder hits, and only reports what it can prove.

AI investigation (investigation)

See AI investigation for setup, step-by-step instructions and scan controls.

Select AI investigation in New Scan and enter an investigation goal. The planner coordinates workers using the AI connection selected in Settings.

Open the resulting scan's Investigation tab to manage goals and constraints, send planner or worker instructions, pause or retry workers, review approvals, and examine the evidence graph and conversation history. Live Feed shows recorded execution activity. Results appear in the same Findings and Reports workflows.

Use Investigate with AI on an existing scan to start a follow-up investigation with its findings as context. There is no separate workspace or login.

Imported observations retain their proof classification. AI assertions are not independent replay verification. General-purpose shell execution has different scope enforcement from deterministic modules; see the deployment's engine integration document for operational boundaries and upstream terms.

What each mode does not change

  • Target validation, tenant permissions and the selected AI connection come from the platform. Deterministic/hybrid scans retain their existing authentication and agent-routing paths.
  • Accuracy Gate + proof status still classify every finding.
  • Manual tabs (HTTP history, Forge, Volley, OAST, …) remain available on the scan detail page for human operators.
  • Agent-relayed deterministic/hybrid scans proxy tool traffic through your local agent. Investigation shell tasks use their separate runtime; saved browser sessions are not automatically transferred.

Choosing a mode

Situation Mode
Staging smoke test, no AI budget Internal Engine
Production / customer-facing pentest with AI narrative + deep dives + AI assist
Goal-driven research and follow-up investigation AI investigation
Cloud-only target (Azure SP / AWS keys) Use the cloud scan / Azure family — mode above is for web/API engines

See also