A Scan Profile holds all the configuration for Application Scanning of your web application, and is also the basis of billing for Starter and Professional plans. You can find all your Scan Profiles under the Application Scanning page.
Scan Profiles allow you to tailor fit the behavior of Application Scanning to your web application, such as adding authentication to scan behind login, or changing what can be scanned. You can run Application Scanning any number of times for a Scan Profile, one scan at a time.
Scan Profiles can be created on assets that host web applications. This asset, known as the Scan Profile endpoint defines the extent of what is scanned, meaning all security tests will be performed on this asset. The web application needs to communicate via HTTP(S) protocol on the ports specified in the scan profile settings (default is 80 and 443).
Read more about setting up Application Scanning and Application Scanning settings.
FAQ
Q: Does the Scan Profile cover all subdomains of the asset?
A: If our crawler discovers links to subdomains during the scan, it will go there and include it in the security testing. You can configure in Application Scanning settings whether you would like to allow crawling of subdomains included in the scan.
Q: I have a domain and an IP for the same asset, on which should I create my Scan Profile?
A: It may depend on the use case. Our general recommendation is to set up the Scan Profile on the domain name, as that allows additional security tests to be executed, for example testing DNS misconfiguration.
Q: Can I create multiple Scan Profiles for the same asset?
A: Yes, you can create multiple Scan Profiles for the same asset, using different configurations to test your web application from different perspectives. For instance, using different user agents for different Scan Profiles to test desktop and mobile versions of your web application.