FAQ
Security scanning FAQ
Short answers about authorization, scope, production safety, reports, rescans and how scanning differs from a penetration test.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan runs automated checks against an application to find known weaknesses. A penetration test has a tester try to exploit weaknesses and chain them together. SkilledScan is a scanner, but it reproduces each candidate before reporting it, so the report holds confirmed findings rather than a raw list of possibilities.
Do you need permission to scan my application?
Yes. SkilledScan only scans targets you own or have written permission to test, and written authorization is confirmed before any scan runs.
How is the scope agreed?
Scope and depth are agreed in writing before testing starts. Checks never run against anything outside the approved scope, and every proposed, allowed and blocked action is written to an audit log.
Can a scan break production?
Checks are rate-limited and non-destructive, and credential brute forcing stays off unless the agreed scope includes it. You can ask for staging instead of production and state any timing constraints when you set up the scan.
Do you test REST and GraphQL APIs?
Yes. API scanning covers REST and GraphQL APIs for broken authorization, injection and data exposure. You can provide an OpenAPI file or a Postman collection, or the routes are mapped first.
Do you need our source code?
No. Scans are black-box: the running application or API is tested from the outside, the way an attacker would see it.
What do I receive?
A report in HTML and PDF with 8 sections, including an executive summary, scope, methodology, findings with evidence and a fix, a remediation summary, and a statement of what was and was not covered.
What happens to results that are not confirmed?
Only findings that are reproduced and confirmed reach your report. Everything else stays in the raw log for audit.
Do you scan again after we fix the findings?
Yes. A rescan covers the findings from a prior scan, and a closeout states what was resolved.
Which tools are used?
The report's appendix lists them so your auditor can see the method. They include Burp Suite Professional, Postman, Acunetix, HCL AppScan, Shodan, theHarvester, NVD, public exploit and advisory databases.
Does a report make us compliant with SOC 2 or ISO 27001?
No. A SkilledScan report is one input to your evidence set: the vulnerability scan evidence. It does not cover the other controls your auditor reviews.
How is data from a scan handled?
Data processed during a scan is covered by the written agreement for that engagement, settled before the scan runs.
Can I start a scan myself?
Not yet. The self-serve console is in development. Until it opens, scans are set up by email at contact@skilledscan.com.
Next step
Send one URL to get started.
Email contact@skilledscan.com with the application or API you want scanned. Written authorization is confirmed before any scan runs.