See what's exposed in your custom apps
Crawl and fuzz the web apps you build, including single-page apps and the parts behind login, with payload-based tests from ethical hackers.
Where Application Scanning fits
Every product runs on the same Discovery layer. Application Scanning takes the custom web apps in it and tests them in depth. Pick domains Surface Monitoring discovered, or add your own.
Discovery
The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.
Surface Monitoring
Application Scanning
API Scanning
InternalInternal Scanning
CompliancePCI ASV Scanning
AI · AgenticAgentic Tooling
NewHow Application Scanning works
Reach the pages a URL list would miss
Application Scanning crawls your app in a real browser, so it renders JavaScript and handles single-page apps. It clicks buttons and fills in forms the way a person would, and maps how pages and inputs connect. Structurally similar pages, like /product/1 and /product/2, are grouped so large apps aren't tested over and over.
- Renders JavaScript and single-page apps built with React, Angular or Vue
- Maps pages and input points as a graph of how users move through the app
- Groups similar pages to cut repeat testing on large apps
Payloads from ethical hackers, fired at your inputs
Application Scanning tests input fields, URL parameters, headers and endpoints with payloads from 1,765+ modules built by ethical hackers in the Crowdsource community. Each module goes through QA review first. It fingerprints your stack, so it runs the modules that fit your technology, and every finding comes with the proof-of-concept payload that triggered it.
- SQL injection, XSS, SSRF, RCE, input sanitization issues and SSL/TLS misconfigurations
- gRPC and Protobuf requests your web app sends are fuzzed too
- 99% of found vulnerabilities have no CVE assigned, based on our own data over the past three years
Test what's behind the login
Record a login once and Application Scanning keeps an authenticated session while it crawls and tests. Admin panels, user settings and other areas your users only see after signing in get the same payload-based testing as the rest of the app.
- Basic access authentication, recorded login and recorded crawling
- Login details saved in reusable scan profiles
- Logged-in areas tested with the same Crowdsource modules
Scan on your schedule
A scan profile keeps scope, login and schedule together, so every scan runs the same way. Run it weekly, set a custom schedule, or trigger it through the API when you ship.
- Weekly, custom or API-triggered scans
- Unlimited scan frequency within your plan
- Requests-per-second limits per origin for sensitive apps
Fix it where your team already works
Findings go to Jira, Slack, Microsoft Teams, webhooks and 100s more tools via Workato. With Jira it works both ways: resolve the ticket and the finding in Detectify updates too.
- Two-way Jira sync for finding status
- Slack and Microsoft Teams alerts
- REST API for your own workflows
Jira ticketWhere security teams put Application Scanning to work
Custom-built apps
Test the code your team ships
Your own web apps don't come with a vendor advisory. Application Scanning crawls and fuzzes the apps you build, including single-page apps and JavaScript-heavy front ends.
Testing behind login
Cover the parts of your app your users see
Admin panels, account pages and user settings only exist after sign-in. Record a login and Application Scanning tests those areas too.
Continuous testing
Test every release, not just once a year
Apps change every sprint. Schedule weekly scans, or trigger a scan through the API when you ship, and send findings to the tools your developers already use.
There are a lot of extremely noisy tools, and they generate a lot of findings, but to get to the true positives, you have to spend a lot of time analyzing the results. So we were very happy with the low rate of Detectify's false positives.
FAQs
SQL injection, XSS, SSRF, RCE, input sanitization issues and SSL/TLS misconfigurations, plus classes beyond the OWASP Top 10 from 1,765+ Crowdsource modules. 99% of found vulnerabilities have no CVE assigned, based on our own data over the past three years.
The tests are payload modules written by ethical hackers in the Crowdsource community, and each one goes through QA review before it runs against customer apps. Every finding comes with the proof-of-concept payload that triggered it, so your team can check the result.
Yes. It supports basic access authentication, recorded login and recorded crawling, and keeps an authenticated session while it crawls and tests. Login details are saved in the scan profile.
It doesn't test business logic or authorization flaws such as BOLA or BFLA, and it can only test what the crawler reaches. For endpoints that aren't linked from the app, use API Scanning with an OpenAPI spec or GraphQL schema. Apps behind CAPTCHA or anti-bot protection don't scan well.
You control the load. Set a requests-per-second limit per origin in the scan profile, which we recommend for sensitive apps, and choose exactly what's in scope.
SaaS, with nothing to install. Your app needs to be reachable from the internet. For apps on internal networks, see Internal Scanning.
Surface Monitoring covers breadth across everything you expose to the internet. Application Scanning goes deep into the web apps you choose, with crawling, fuzzing and testing behind login. You can pick apps from the assets Surface Monitoring discovered or add them yourself.
Pricing is per target and tiered by the number of targets, with unlimited scans within your plan. You can try it for free for 2 weeks. See pricing.
Surface Monitoring
Finds the domains, subdomains, IPs and open ports you have on the internet, and recommends which apps need a deeper scan.
Learn more about Surface Monitoring
API Scanning
Payload-based testing for REST and GraphQL APIs, driven by your OpenAPI spec or GraphQL schema, including prompt injection on AI endpoints.
Learn more about API Scanning
Internal Scanning
The same payload-based testing for internal apps, through an agent that only connects outbound.
Learn more about Internal ScanningAdd your app and start scanning
Crawling, fuzzing and testing behind login for the web apps you build.