App & Infrastructure Scanning
Cloud Security tells you how your accounts are configured. This section covers everything you build and run on top of them: the web apps and APIs you expose, the hosts behind them, the container images you ship, the Kubernetes clusters they run in, and the source code they came from. Each area has its own workspace, but every result becomes a finding with a severity, an affected resource and a fix, and flows into the same triage, risk and reporting pipeline.
The five workspaces
| Workspace | Where | What you scan | Engines |
|---|---|---|---|
| Web, API & Host Scans | Scanning → New Scan | URLs, APIs, hosts, TLS endpoints | OWASP ZAP, Nuclei, Nmap, testssl.sh, native header / API / fingerprint analyzers |
| Code Command Center | Code Command Center | Git repositories, uploaded archives, build artifacts | OpenGrep + Bandit (SAST), OSV.dev (SCA), Gitleaks (secrets), Checkov (IaC), Syft + Grype (SBOM / images), SonarQube |
| Container Security | Container Security | Images in ECR / Artifact Registry / ACR / Docker Hub, Dockerfiles | Trivy, Grype, Syft, native Dockerfile rules |
| Kubernetes Security | Kubernetes Security | EKS / GKE / AKS / on-prem clusters | kube-bench, Polaris, Kubescape, Trivy, kube-hunter |
| Infra Command Center | Infra Command Center | CI pipelines, WAF rules, API endpoints under load | CI/CD API keys, WAF test suite, load tester |
Results from the first workspace land in the Scan Results hub; the other four keep their own results tabs and also feed the unified views.
How it fits together
- Scan — from the UI, on a schedule, or from CI (
scan.sh, the CLI, or the API). - Finding — every engine's output is normalised, deduplicated across runs, and kept with its history; your triage decisions (resolved, false positive, suppressed) survive re-scans.
- Risk — findings roll into Vulnerability Management for SLA tracking and into the Risk Register when they need an owner.
- Report — per-scan HTML / PDF / Word reports, consolidated reports across scans, and compliance mappings (OWASP, CIS, NIST, PCI DSS, SOC 2).
Start here
| If you want to… | Go to |
|---|---|
| Test a website or API before release | Running Web, API & Host Scans |
| Scan a repository or wire scans into CI | Connecting Repositories → Running Code Scans → CI/CD & Automation |
| Scan the images in your registries | Registries → Image Scanning |
| Assess a cluster | Onboarding Clusters → Scanning & Findings |
| Schedule everything | Scan Management & Scheduling |
| Automate over REST | Scanning API |
Web, API, network and load tests send real traffic to the target. Run them only against systems you own or are explicitly authorised to test, and use the gentler scan profiles on production.
Prerequisites
- Platform permissions: Run Scans to start scans, View Scans to read results, Manage Container Security for registries, policies and clusters (RBAC).
- For registries and clusters discovered from the cloud: a connected account (Connecting Cloud Accounts) with the roles in Required Permissions.
- For repositories: a Git provider token (GitHub, GitLab or Bitbucket) with read access.