Getting Started

What is an accepted risk?

An accepted risk is a finding that you no longer want alerts about, such as a port that is open by design, a false positive, or a low-priority finding.

What is a closed risk?

A closed risk is a finding from an earlier scan that the most recent scan no longer detects. HostedScan keeps closed risks as an audit trail.

How can I use tags to manage my scans and risks?

How to tag targets so that you can run scans by tag, keep scheduled scans current as targets change, and accept risks across many targets at once.

Why are my open ports considered a vulnerability?

HostedScan reports every open port as a risk until you accept it, because an open port can expose a database or admin panel to the internet.

Can HostedScan run internal network scans?

On Premium plans and above, the HostedScan Internal Scanner runs vulnerability scans inside your network with no open ports and reports to your dashboard.

Setting up authenticated scans (OWASP Zap)

Scan the pages behind your login with OWASP ZAP. Set up authentication with a recorded Selenium login, basic authentication, or custom headers and cookies.

Can I export vulnerabilities to a CSV or Excel file?

On Premium plans and above, export vulnerabilities from the Reports page as a CSV file, then open it in Excel or load it into a BI tool for your own analysis.

Can I scan for OWASP Top 10?

The OWASP ZAP scan in HostedScan tests for the vulnerability categories in the OWASP Top 10 and more. See which ZAP tests cover each Top 10 category.

How do I see all of the vulnerabilities that were tested?

How to download the output files of a scan from the Scans page, such as the ZAP output file that lists every rule that the scan passed.

How long will a scan take?

Typical scan times for OpenVAS, OWASP ZAP, Nmap, and SSLyze, from a few minutes for an SSL scan to a day or more for a large network or web application.