Reading Scan Results
Path: /scans/[id]
The scan detail page is where a run unfolds and where you interpret what was found. It updates live while the scan is running.
While it runs: the Agent Cockpit
The live view is the Agent Cockpit - a narrated, first-person view of the autonomous pentest rather than a flat log:
- Agent now - a one-line intent ("probing the coupon parameter for SQLi") that updates as the agent reasons.
- Task tree - the phases of the run, from crawl through the agent pentest, with per-phase status and engine badges.
- Live kill-chain - the chain of capabilities the agent has proven so far, building in real time.
- Activity narration - typed tool-call cards and conversational reactions to what each probe returned. A visible SAFE signal shows while non-destructive checks run.
See Agent Cockpit & Attack Trace for the full guide to the live view.
Attack Map
A visual map of the discovered surface: endpoints, parameters and the paths the scanner exercised. It shows where attacks landed and which routes were reached - the basis for the coverage score.
Findings & proof-of-exploit
Each finding row carries a severity, name, affected URL and source. Expand one to see:
- Attack Trace - for a confirmed finding, the proven kill chain leads: numbered agent steps, Validated / Working-exploit / SAFE chips, a masked proof receipt, and the Proven Impact - not just a CVSS number. This is the strongest signal for prioritisation. See Agent Cockpit & Attack Trace.
- Evidence - the request/response pair that triggered the detection.
- Proof-of-exploit - the actual exploit interaction. When you see Exploit confirmed, apPosture proved it (not an AI guess).
- Attack-path impact - how the finding sits in the wider graph ("fixing this breaks N of M attack paths"), so you fix the highest-leverage root cause first.
- AI analysis - false-positive judgement, business impact, and a suggested fix.
- Remediation - concrete steps and references (CWE/OWASP).
App model
A structured model the engine built of the application (routes, parameters, auth state). Confirms what the scanner understood about the app - handy when results look thinner than expected.
Traffic
The full request/response traffic the engine sent and received during the run is captured for review - useful for verifying a finding by hand or understanding exactly what the agent tried.
Coverage panel
A quantified coverage score and grade with per-technique attribution: how much of the surface was crawled and tested, and honest caveats about what wasn't reached. Low coverage usually means auth wasn't working or scope was too narrow - fix those and re-scan rather than trusting a clean-looking result.
Report tab
Generate a per-scan report from the Report tab, with selectable compliance frameworks and export formats (including a high-fidelity PDF). The Autonomous Pentest report is the vendor-grade deliverable for a single engagement. For portfolio-level reporting see Reports.
Always check coverage before concluding "no issues." A 100% clean scan with 10% coverage tested almost nothing.