Skip to main content

Quick Start

This walkthrough takes you from an empty workspace to your first triaged finding in about ten minutes. You will create an Application, add a Target, run an Autonomous Pentest, and read the results.

Prerequisites

You need a user account with permission to create targets and run scans (the Analyst role or higher). If you can see the DAST Scans item in the sidebar, you are good to go.

Step 1 - Create an Application​

An Application is the business-level unit everything rolls up to (a product, a service, a website).

  1. In the sidebar, open Assets → Applications.
  2. Click New Application (top right).
  3. Fill in:
    • Name - e.g. Customer Portal.
    • Environment - Production, Staging or Development.
    • Business criticality - Low → Critical. This weights the risk score.
  4. Click Create.

You now have something for findings to roll up to. See Applications for the full reference.

Step 2 - Add a Target​

A Target is a concrete URL apPosture will scan.

  1. Open Assets → Targets.
  2. Click New Target.
  3. Enter:
    • Name - Customer Portal - prod.
    • URL - https://app.example.com.
    • Application - select the app from Step 1.
  4. (Optional) Add authentication so scanners test logged-in pages - see Authenticated Scanning.
  5. Click Create.

Step 3 - Run an Autonomous Pentest​

An Autonomous Pentest is apPosture's dynamic engine: it maps your attack surface (DAST crawl + active scan), then exploits it with an adaptive AI pentester - and proves each finding. (In the UI this is the Autonomous Pentest page.)

  1. Open Testing → Autonomous Pentest, then click New Scan.
  2. Select your Target.
  3. Choose a profile:
    • Quick ~5 min - smoke test.
    • Standard ~30 min - recommended first run.
    • Deep 1-2 h - full crawl + all engines + AI exploitation.
    • Savage 2-4 h - most aggressive: adds offensive recon, WAF-bypass mutation, deep content discovery, OAST and LLM app-security. Requires explicit authorization.
  4. Click Start Scan.

You are taken to the scan detail page. The Autonomous Pentest runs in two visible stages - DAST (crawl + active testing) and AI exploitation (adaptive, proof-based) - with a live progress bar and an activity log. You can leave the page; the scan keeps running.

Step 4 - Read the findings​

When the scan completes:

  1. On the scan detail page, scroll to Findings. Each row shows a severity, name, affected URL and source.
  2. Click any finding to expand its evidence, proof-of-exploit (the actual request/response that demonstrates the issue) and remediation.
  3. Note the Attack Map and Coverage panels - they show what was reached and tested. See Reading scan results.

Step 5 - Triage in the Vulnerabilities hub​

Findings from every tool land in one place.

  1. Open Findings → Vulnerabilities.
  2. Filter to your application or scan.
  3. Open a finding and set its status (Triaged, Confirmed, False positive, Risk accepted, …) and optionally assign an owner.

That is the core loop: scan → review → triage. The Vulnerabilities page documents the full workflow.

What next?​

Last updated on