Getting Started

What is an accepted risk?

An accepted risk is a finding that you no longer want alerts about, such as a port that is open by design, a false positive, or a low-priority finding.

What is a closed risk?

A closed risk is a finding from an earlier scan that the most recent scan no longer detects. HostedScan keeps closed risks as an audit trail.

How can I use tags to manage my scans and risks?

How to tag targets so that you can run scans by tag, keep scheduled scans current as targets change, and accept risks across many targets at once.

Why are my open ports considered a vulnerability?

HostedScan reports every open port as a risk until you accept it, because an open port can expose a database or admin panel to the internet.

Can HostedScan run internal network scans?

Yes, HostedScan can run scans on servers in your internal network.

Setting up authenticated scans (OWASP Zap)

You can setup scans to scan as a logged in user of your website or web app.

Can I export vulnerabilities to a CSV or Excel file?

Export vulnerabilities to CSV for analysis and use with BI tools.

Can I scan for OWASP Top 10?

Support for OWASP Top 10 with HostedScan

How do I see all of the vulnerabilities that were tested?

How to download the output files of a scan from the Scans page, such as the ZAP output file that lists every rule that the scan passed.

How long will a scan take?

How Long Do Vulnerability Scans Take? OpenVAS, OWASP ZAP, Nmap, SSLyze