AI-Powered Scanning and Scale

CyStack VulnScan is an AI-powered vulnerability scanner. Its core scanning workflow still collects technical evidence through discovery, fingerprinting, crawling, active checks, and vulnerability intelligence, while AI can be enabled as an additional analysis layer to improve detection quality, reduce false positives, and make results easier to act on. AI is optional and depends on the licensed package and configuration. Organizations can run VulnScan without AI, connect it to an approved AI cloud provider, use a local/private AI endpoint, or deploy a dedicated AI worker or agent for restricted environments.

Where AI Helps

AI-assisted analysis can support multiple stages of the scan lifecycle:

Stage	AI-Assisted Value
Discovery review	Identify suspicious endpoint names, parameter patterns, exposed admin surfaces, and API shapes that deserve deeper checks.
Crawling and parameter context	Help classify forms, request parameters, API routes, and response patterns so relevant checks can be prioritized.
Vulnerability detection	Assist with identifying anomaly patterns in HTTP evidence, response differences, weak access patterns, and issue-specific signals.
False-positive reduction	Review whether evidence is strong enough, whether a version-based match has enough context, or whether a finding should be marked for human validation.
Deduplication and grouping	Help explain related findings that appear across similar endpoints, hosts, or services.
Prioritization	Combine severity, exploitability, KEV, EPSS, exposure, authentication context, and business-facing surface into clearer remediation order.
Remediation guidance	Convert technical evidence into practical fix guidance for security, infrastructure, and application teams.
Bilingual reporting	Produce clearer English and Vietnamese explanations, summaries, and executive-level narratives.

AI does not remove the need for evidence. Findings still remain tied to collected scan data such as affected URL, host, port, service, request/response evidence, detected version, CVE, CWE, CVSS, EPSS, KEV status, and confidence.

AI Configuration Options

Administrators can choose the AI integration model that matches their data policy:

Option	Best For	Notes
AI cloud API token	Fast enablement and elastic capacity.	Use a provider approved by the organization. Review what scan context may be sent.
Local/private AI endpoint	Sensitive environments and on-premises deployments.	Keeps analysis traffic inside the customer-controlled environment.
Dedicated AI worker or agent	Larger deployments or restricted networks.	Separates scanning workload from AI analysis and allows independent resource control.

When configuring AI, use a dedicated token or service account where possible. Rotate credentials according to your organization’s policy.

Data Handling

Before enabling AI, decide which scan context is allowed to be processed:

Vulnerability titles, severity, CWE/CVE, and remediation context.
Affected URL, host, port, service, technology, and version evidence.
HTTP request/response snippets where needed for analysis.
Authentication context status, without exposing secret tokens or passwords.
Business labels such as production, staging, customer-facing, or critical.

Avoid sending real credentials, personal data, secrets, session tokens, or sensitive customer data to external providers. Use local/private AI mode when strict data residency or confidentiality requirements apply.

Scale Model

VulnScan scales through concurrency, persistence, and workflow separation:

Layer	Scale Mechanism
Discovery	Concurrent host discovery, subdomain discovery, live probing, and port scanning with configurable rate limits.
Fingerprinting	Parallel service fingerprinting, HTTP probing, TLS probing, technology detection, and protocol-specific checks.
Crawling	Web and API endpoint discovery with bounded crawling and parameter extraction.
Detection	Concurrent verification workers and targeted checks to avoid running every check blindly against every endpoint.
AI analysis	Optional background analysis that can run through a cloud provider, local endpoint, or dedicated worker.
Enrichment	Local intelligence data for CVE, CVSS, EPSS, KEV, CWE, OWASP Top 10, and WSTG.
Storage	Database-backed scan history, findings, source metadata, triage state, and report jobs.
Reporting	CSV/JSON exports for automation and PDF exports as background jobs.
Automation	CLI supports target files, multiple targets, subdomain expansion, output directory control, language selection, and CI/CD usage.

Default Concurrency Profile

The default configuration is tuned for balanced throughput:

Area	Default
Discovery workers	256
Port scan rate limit	1000
Port scan profile	Top 1000 TCP ports
Fingerprint workers	50
Service-version parallelism	4
Active detection workers	25
Enrichment workers	10

For large environments, start with smaller batches, confirm network stability, then increase scope. Rate limits should match the customer’s authorization, bandwidth, and target tolerance.

Large-Scale Scan Strategy

For a large workspace:

Add root domains and owned CIDR ranges first.
Run discovery to understand real asset volume before broad scanning.
Split large portfolios by business owner, environment, or risk tier.
Use scheduled scans for critical production assets.
Use CLI scans for CI/CD pipelines, batch automation, and controlled recurring jobs.
Enable authenticated scan context for applications where important functionality is behind login.
Enable AI-assisted analysis when the organization wants deeper evidence review, prioritization, and remediation explanation.
Export CSV/JSON for SIEM, ticketing, data lake, or workflow automation.
Use PDF for human-readable reports and executive delivery.
Configure email notifications so scan completion and PDF export readiness do not depend on an open browser tab.

Data Consistency at Scale

Standard scans launched from Web UI, CLI, or schedules are written to the same database. This matters when multiple teams use the product:

CLI automation can run overnight.
Analysts can review the results in the Web UI the next morning.
Reports can be generated from the same persisted scan.
Scan source remains visible for auditability.
Finding triage state stays consistent regardless of how the scan was launched.

Offline and Restricted Environments

For environments without reliable Internet access, prepare scanner artifacts and vulnerability intelligence in advance:

vulnscan prep-offline

Restricted environments can combine offline activation, prepared intelligence data, local report generation, and local/private AI analysis when data cannot leave the network.

Introduction

Getting started

Vulnerability scanning

WAF — Web Application Firewall

Automation & CLI

Security reference

Administration & operations

Where AI Helps

AI Configuration Options

Data Handling

Scale Model

Default Concurrency Profile

Large-Scale Scan Strategy

Data Consistency at Scale

Offline and Restricted Environments

​Where AI Helps

​AI Configuration Options

​Data Handling

​Scale Model

​Default Concurrency Profile

​Large-Scale Scan Strategy

​Data Consistency at Scale

​Offline and Restricted Environments

Where AI Helps

AI Configuration Options

Data Handling

Scale Model

Default Concurrency Profile

Large-Scale Scan Strategy

Data Consistency at Scale

Offline and Restricted Environments