Quick Start Guide: PTaaS Lite

Get your first validated findings in PTaaS Lite by adding your web application, running a scan, and working through the results. You run every step yourself, and AI agents validate findings and verify your fixes along the way.

What You Do vs. What the AI Agents Do

Step 1: Add Your Target

1. Navigate to Vulnerabilities → Targets.
2. Click Add Target.

   

3. Enter a name for your target in the Target Name field.
4. Enter the target URL in the Target URL field. Make sure the URL doesn't have a trailing slash.
5. Select Web App from the Target Type dropdown.
6. Select the target environment, and enter the POC details and any out-of-scope URLs.
7. Click Next.
8. Select your authentication method from the Auth Method dropdown, select the role to test, and enter the required details.

9. Click Next.
10. Upload your code archive, API specification, and supporting documents in the scan context fields. These are optional.
11. Review your details and click Save.

Your target appears in the Targets table.

Step 2: Run a Scan

1. Navigate to Vulnerabilities → Targets.
2. Click Start scan in the Actions column of your target.

Heads Up! Your Findings list stays empty while the scan runs, and findings appear only after the AI Validation agent finishes validating them.

Step 3: Review Validated Findings

When validation completes, you receive a notification, and your findings appear with Open status.

1. Navigate to Vulnerabilities → Findings → All Findings.
2. Use the Scrut Teammates Validation filter to show Likely True Positive or Likely False Positive findings.

   

3. Click a finding to open its detail page.
4. Click on any affected resource to view more details. The drawer shows how the agent tested each affected resource, including its request, response, rationale, and evidence.

   

The SLA for each finding starts when the agent publishes it after validation.

Step 4: Fix and Submit for Verification

1. Fix the vulnerability in your application.
2. Navigate to Vulnerabilities → Findings and click the finding you fixed.
3. Click Submit For Verification.

   

4. Click Submit in the confirmation window.

The finding status changes to Pending Verification, and the AI Verification agent re-attacks every open affected resource. When verification completes, you receive a notification:

• Closed: The fix held on every affected resource. The SLA stops.
• Reopened: At least one resource is still exploitable. Fixed resources show Closed, so you know exactly what remains. The SLA continues from the original publish date.

To fix and resubmit a reopened finding, repeat the steps above.

Step 5: Handle Findings You Won't Fix

For findings that don't apply to your environment, or that your team decides not to fix:

• Ignore: Open the finding, click the three-dots icon, and click Ignore. All affected resources in Open or Reopened status are also ignored. Click Undo Ignore at any time to return the finding and its resources to Open.
• Add Risk: Open the finding and click Add Risk. The finding status changes to Risk Accepted, affected resources in Open or Reopened status are also marked Risk Accepted, and a linked risk is created in the Risk Register.

Your PTaaS Lite program is now running. Run your next scan when your scan allowance resets.

FAQs

Reach out to support@scrut.io or contact your CSM for further assistance.