​

Shallow Audits

A shallow audit is the fastest engagement mode. A deterministic baseline scanner maps your attack surface and probes it for known issues, without the full agent attack chain.

​

What it covers

1. Baseline scan — nuclei templates, security-header checks, and common-path probes (.env, /.git/config, /wp-admin/, /actuator/env, swagger endpoints, and more). Deterministic, fully structured findings.
2. Asset discovery — subdomain enumeration and validation against the target.
3. Live probing — each discovered asset is checked for meaningful exposure.
4. Report — score, coverage summary, and findings.

​

What it skips

Shallow audits do not run the deep agent phases: no credential attacks, no chained exploitation, no post-exploitation. If the surface warrants deeper testing, run a Deep audit.

​

When to use

• Continuous coverage — schedule daily or weekly runs against production
• Regression testing — verify a previously remediated finding is gone
• Fast triage — see what a fresh attack surface exposes before investing in deep mode
• Many apps — cheap enough to cover everything you own

​

Expected output

A typical shallow audit produces 0–15 findings, predominantly Medium and Low, with occasional High for clear misconfigurations (exposed .env, missing auth on an admin path). For issues where confirming impact needs deeper exploitation, run a Deep audit on the same target.

​

Next steps