Vulnerabilities Overview

The Vulnerabilities module brings the security weaknesses in your applications and infrastructure into one place in Scrut. Whether a vulnerability comes from Scrut's own scanning, the security tools you already use, or a penetration test, you can review it, act on it, and connect it to your risk and compliance work from the same module.

What Is a Vulnerability?

A vulnerability is a security weakness in an application, system, or software component that an attacker could exploit to gain unauthorized access, steal data, or disrupt your service. Common examples include injection flaws, broken authentication, server misconfigurations, missing security headers, and outdated components with a known Common Vulnerabilities and Exposures (CVE) identifier.

Finding and fixing vulnerabilities matters for two reasons:

• Security: Every unresolved vulnerability is a potential entry point. The earlier you find it, the less time an attacker has to use it.
• Compliance: Frameworks such as SOC 2, ISO 27001, and PCI DSS expect evidence that you test your systems regularly and remediate what you find.

How Scrut Finds Vulnerabilities

Scrut offers four ways to find vulnerabilities. They differ in who runs the testing, how findings are reviewed before you see them, and how often testing happens.

DAST

Dynamic Application Security Testing (DAST) scans your running websites and web applications from the outside, like an attacker would, by sending requests and analyzing responses. Because it tests the live application, DAST catches runtime issues such as configuration errors, authentication flaws, and exposed endpoints.

You add each website or web application as a target from Vulnerabilities → Targets, then choose:

• Scan frequency: On-Demand, every 3 days, Weekly, or Monthly.
• Scan mode: Quick Scan is a rapid, non-intrusive scan suited to production environments. Full Scan is deeper and simulates attacks that may modify data, so run it in staging or other lower environments.
• Authentication: None, Cookie, Token, or Credentials. Authenticated scans reach pages behind a login, which improves coverage.

DAST complements penetration testing rather than replacing it. A pentest gives you a deep, point-in-time assessment. DAST keeps testing in between, so you catch vulnerabilities introduced with each release. If a finding needs specialized security knowledge to resolve, you can get expert assistance from Scrut's security analysts.

Third-Party Scans

If you already run vulnerability scanners, Third-Party Scans consolidates their findings in Scrut so you can manage everything from one place. You can bring findings in two ways:

• Integrations: Connect a supported vulnerability scanner, such as Qualys, Snyk, or Tenable, and its findings sync to Scrut.
• Imports: Upload findings from external reports.

In Vulnerabilities → Third-Party Scans, the Findings tab lists each vulnerability with its severity, source tool, CVE ID, and SLA status. The Resources tab flips the view to show which assets carry the most exposure.

PTaaS Pro

PTaaS Pro is Scrut's managed penetration testing program. Scrut's certified Security Experts, working within a CREST-accredited organization, run your testing, review every finding before it reaches you, and verify every fix you submit. Your role is to onboard your targets and remediate verified findings.

PTaaS Pro keeps your coverage current throughout the year with two types of activity:

• Full Pentests run twice a year and combine automated scanning with manual expert testing. Each one produces an audit-ready report you can share with auditors, enterprise customers, and other stakeholders.
• Release Scans run monthly and check for regressions, such as previously fixed vulnerabilities that reappear in new code. They don't produce a formal report.

Scrut schedules both according to your Program Calendar, so you don't trigger scans yourself.

PTaaS Lite

Penetration Testing as a Service (PTaaS) Lite is self-serve, AI-validated penetration testing for one web application. You add your target, run a scan yourself once every 30 days, and manage every finding end to end.

Two AI agents handle the review work:

• The AI Validation agent re-attempts to exploit each suspected vulnerability after a scan and tags it as Likely TP (true positive) or Likely FP (false positive). Findings appear in your list only after validation completes.
• The AI Verification agent re-attacks a finding after you submit a fix. The finding closes only if the fix holds on every affected resource.

You stay the final decision maker. The agents label and verify findings, but you decide how to act on each one.

Choose the Right Option

These options work well together. Many teams combine them based on their security program and compliance needs:

• Use DAST for continuous, automated coverage of your live applications between pentests.
• Use Third-Party Scans to centralize findings from the scanners you already run.
• Use PTaaS Lite when you want to run penetration testing yourself for a single web application, with AI validating the results.
• Use PTaaS Pro when you need expert-led testing and audit-ready pentest reports for compliance or enterprise security reviews.

Manage Findings in One Place

Whatever the source, the Vulnerabilities module helps you move findings from discovery to resolution. Depending on the source, you can:

• Track remediation deadlines with SLAs for vulnerability findings.
• Create Jira tickets to route fixes into your engineering workflow.
• Add a finding to the Risk Register when it carries broader business impact.
• Capture extra context with custom fields for vulnerability findings.
• Download the vulnerability report to share your status with stakeholders.

Contact support@scrut.io or your CSM for further assistance.