Articles on: Security Scan

Run a Security Scan Step by Step

The New scan wizard in the Security Center lets you check a host on your domain for vulnerabilities. This article walks you through the four steps and explains credits, scheduling and what happens while a scan runs. For an overview of the Security Center, see "Security Center Overview: Issues, Scans, Domains and Exposure".

Before you start

Only company admins can start, schedule and cancel scans. All members can view scans and their results.
The domain must be verified, monitoring must be on, and Vulnerability Scans must be switched on in the domain's Settings tab. Vulnerability scanning is off by default.
Only approved hosts can be scanned. The verified root host is approved automatically; other hosts are approved in the domain workspace.

Open the wizard with New scan on the Scans page or in a domain's workspace.

Step 1 – What to scan

Scan wizard step 1: choose the domain and the approved host

Choose a Monitored domain and then one Approved host. Domains that need attention – not ready, with open issues or never scanned – are listed first. If a domain is not ready yet, the wizard shows which setting is missing and links to the domain settings.

With two or more approved hosts you can also choose All approved hosts. This runs one Expanded scan per host.

Step 2 – How deep

Scan wizard step 2: Baseline, Expanded, Authenticated and Deep Active with credits

Scan type	What it does	Effect on the host	Credits	Maximum duration
Baseline	Safe checks of the host's essentials	Read-only	One per host in each scan period of your plan (daily, weekly or monthly) included, further Baseline scans 5	120 min
Expanded	Broader discovery, ports, crawling and safe tests	Read-only	30	90 min
Authenticated	Expanded coverage using a login you provide	Signs in, but only reads	45	120 min
Deep Active	Active tests with explicit authorisation	May create, edit or delete records	75	240 min

Each card shows the credits left after the scan and a box What … will not cover, for example pages behind a sign-in for Expanded scans.

On this step you can also switch on External port exposure scanning for the domain. This is a domain setting: it is saved right away and applies to future scans too.

Step 3 – Access & schedule

An Authenticated scan needs an Authentication profile; for Deep Active it is optional. Pick an existing profile or click Create. Supported types include browser login (also with SSO and MFA), basic authentication, bearer token, custom headers, query parameter and cookie. Use Test to check that the sign-in works – scans that need a verified profile only offer tested profiles.

Secret values are write-only: they are stored encrypted, never shown again and never written to logs. To change a secret, use Rotate secret.

For Deep Active you can also attach an OpenAPI document, so API operations that crawling does not find are tested too.

Deep Active authorisation

Deep Active runs against the live system, not a copy. Records may be created, edited or deleted, and forms and API requests are re-sent with test data. To continue, type the exact host name. Two options are off by default: letting the scanner click visible controls, and file upload testing (uploaded test files may remain on the system). Only use Deep Active if you are allowed to test the system and have a backup.

Schedule

Choose One-shot scan to start now, or Recurring scan. Only an Expanded scan of a single host can repeat – Daily, Weekly or Monthly, as often as your plan allows. You can run the first scan as soon as possible or pick a First run time.

Recurring scans use credits from a company-wide budget: the Scheduled security scan credit limit under Settings → Billing → Billing settings. It is 0 by default, which means no scheduled paid scans run. If a scheduled run is not covered by the limit or by your credits, it is skipped and the schedule continues with the next date.

Step 4 – Review & start

Scan wizard step 4: review targets, credits and what the scan covers

The summary shows the targets, depth and runs, the credits (available, this scan, remaining), What will happen and What it will not cover. Click Start … scan (or Schedule … scans).

If there are not enough credits, the scan cannot be started – unless your contract includes paid overage. You can buy more credits from the link on this step (see "How Credits Work – Costs, Balance and Buying More").

While the scan runs

The scan page refreshes itself and shows each stage, for example port scan, site crawl and vulnerability checks.
Scans run one after another. If another scan is running, yours waits as Pending.
A host can have one active scan at a time, and a paid scan can start at most once every 10 minutes per host.
Admins can stop a scan with Cancel scan. If you cancel before the scan has started working, the credits are released. A scan you cancel after it has started is still charged. Credits are refunded automatically if a scan fails because of a problem on AutoPhish's side.

Results

The Scans page lists all scans with domain, target, scan type, status, findings and start time. Open a completed scan to see its findings. You work on them in Issues – see "Security Center Overview: Issues, Scans, Domains and Exposure". If a scan shows "Coverage incomplete", parts of the host could not be checked, so "no findings" is not a clean result.

To scan again, start a new scan with New scan.

Good to know

AutoPhish never performs denial-of-service tests, brute force attacks or credential stuffing.
Starting scans, cancellations and changes to authentication profiles are recorded in the Audit Log.

Updated on: 28/10/2026

Was this article helpful?

Thank you!