Scan Modes
An active test runs in one of three scan modes: Quick, Standard or Deep. The mode is a property of the target you save, and it decides two things — how long the test may run, and how deep into the severity range its signature checks go.
| Mode | What it does | Time budget | Severity focus |
|---|---|---|---|
| Quick | Crawls the application; sends no attack payloads | Up to 15 minutes | Critical, High |
| Standard | Crawls, then attacks the parameters it finds | Up to 1 hour | Critical, High, Medium |
| Deep | Everything Standard does, wider and longer | Up to 4 hours | Critical, High, Medium, Low |
Each mode is priced separately, and the price is shown before you confirm a run.
infoWhat the severity focus does and does not mean. It sets how deep the signature checks go — a Quick run does not load the medium-severity signatures at all. The configuration checks that run off the crawl are not limited by it, so a report can still contain an item below the mode's headline range. The range tells you where a mode concentrates its time, not a hard floor.
The time budget is a ceiling, not a target. A small application finishes well inside it. If a large one reaches the ceiling, the test stops there and reports what it had already proven, recorded as a partial run rather than a clean one.
Looking for the assessment that sends no traffic at all? That is a black-box scan, run against a verified domain rather than a target, and it has no mode to choose.
Quick
Up to 15 minutes. Crawls the application; does not attack it.
Quick walks your application the way a search engine would, then inspects what comes back. It flags issues visible in the responses themselves — security headers that are missing or weak, cookies without the right protections, permissive cross-origin policies, exposed administrative or diagnostic paths, information disclosure in error pages, and components that announce a known-vulnerable version in their response headers.
Its signature sweep is loaded with the critical and high severity checks only, which is what keeps it to fifteen minutes.
Use it for
- A first look at a new environment
- A fast confidence check after a deployment or an infrastructure change
- A regular cadence between deeper assessments
What it cannot tell you
Quick sends no attack payloads, so it does not find injection, cross-site scripting, or anything else that only reveals itself when a parameter is manipulated. If you need those, run Standard.
Standard
Up to 1 hour. Crawls, then attacks what it finds. Recommended for most teams.
Standard is a full black-box penetration test of the application. It crawls the site to discover pages, forms, query parameters and API endpoints — including a headless browser pass, so a JavaScript front end's XHR and fetch endpoints are discovered rather than only the shell it serves. It then attacks the parameters it found with the payload classes an attacker would use, and reads the responses for proof that the payload worked.
What it reports
- SQL injection and other database injection
- Cross-site scripting, reflected and stored
- Command injection and server-side template injection
- Path traversal and local file inclusion
- Server-side request forgery
- Authentication and session handling weaknesses
- Access control problems reachable from the outside
- Everything Quick reports — misconfiguration, headers, cookies, exposure
Use it for
- The default choice for a production or staging application
- Before a release, a security review, or a customer security questionnaire
- A regular schedule — quarterly is typical, monthly for a fast-moving app
Deep
Up to 4 hours. Everything Standard does, with wider coverage and lower severity reporting.
Deep differs from Standard in three ways:
- A second, browser-driven crawl. Standard already discovers JavaScript-rendered endpoints for its attack phase. Deep additionally drives the active scanner's own browser crawl over the application, which reaches routes that only appear after an interaction — a tab opened, a menu expanded, a step completed. On a single-page application this is usually the difference between testing part of the app and testing the app.
- A longer attack budget. Four hours instead of one, so more parameters are attacked, with more payload variations each, and slower or more conditional flaws have time to surface.
- Low-severity reporting. Deep loads the low-severity signatures the shorter modes leave out, which adds the hardening and best-practice findings they suppress to stay focused.
Use it for
- Before an external audit, a penetration-test attestation, or an enterprise security review
- A JavaScript-heavy application where Standard's coverage looks thin
- The highest-value application you run, at least once a year
- When you want the full picture rather than only what is urgent
Trade-off
Deep is the slowest mode and produces the longest report. Its low-severity findings are genuine but rarely urgent — treat them as a hardening backlog, not a release blocker.
Choosing a mode
| Your situation | Run |
|---|---|
| You want a fast answer after a deploy | Quick |
| You want to know if it can actually be exploited | Standard |
| Single-page app with most routes behind JavaScript | Deep |
| Audit, attestation or enterprise review coming up | Deep |
| Regular ongoing assurance | Standard on a schedule, Deep annually |
| You cannot send traffic to the system at all | Black-box scan |
The three modes are cumulative: anything Quick can find, Standard also finds, and anything Standard finds, Deep also finds. Choosing a deeper mode never costs you coverage, only time.
Setting the mode
The mode lives on the active test target. You choose it when you save the target, and change it by saving the target again — see Active Test Targets.
The mode that runs is always read from the saved target rather than from the request that starts the run, so the price you are quoted is always the price of the assessment that actually executes.
