Scan Robots

​

What are Scan Robots?

Scan Robots are predefined workflows that run multiple security tools in sequence. Each robot defines a series of scans where output from one tool feeds into the next. You choose a target and start the robot, then review the results. Robots can be shared with team members. See Sharing robots for details.

​

Default robots

Starting November 3, 2026, these six robots replace the previous default robots:

​

Robot workflows

​

Running a robot

​

Scheduling robots

Robots can run on a schedule:

​

Managing robots

​

Viewing robot details

Click on any robot to see:

• Description of what the robot does
• The workflow and tools it uses
• Available actions depend on your permissions.

​

Editing robots

You can’t create new robots or edit existing ones. Robots you created earlier stay in your account with their scan history.

​

Deleting robots

Deleting a robot removes the robot configuration. Past scan runs are not deleted. They remain on the Scans page but show “[Robot deleted]” as their name. To remove a past run, delete it from the Scans page.

​

Robot execution

Tools run in the order the workflow defines, and some steps run in parallel. Some robots include filters that control which results trigger subsequent steps.

​

Node types

The workflow diagram has four node types:

• Tool runs one or more scans. Shows status and finding counts as work progresses.
• Filter tests conditions against each result from the previous tool. Only matching results move to the next step. The node shows how many results passed through.
• Extractor pulls new targets out of a tool’s results to feed the next tool. For example, it might pull hostnames from Subdomain Finder results, or build URLs from a port scan’s list of open HTTP ports.
• Reducer works like an extractor, but processes all scan results together before producing targets. Its primary use is deduplication: when Subdomain Finder returns multiple subdomains that resolve to the same IP, a reducer picks one hostname per IP to avoid scanning the same server twice.

​

Monitoring progress

The scan result page shows the robot workflow as an interactive diagram. Each node updates as the robot runs. Tool nodes show the tool name, a status indicator, and finding counts by severity. When scans start for that step, a “X / Y Finished Scans” button appears. Click it to open a panel listing each individual scan with its target, status, and finding summary. From that panel, click any scan to open its full result in a new tab. Scans that failed to start appear in the same panel with their error message. You can pan the diagram by clicking and dragging. Use the + and − buttons to zoom.

​

Results

When the robot finishes, the diagram shows the final state with finding counts at each tool step. To see findings in detail, click the Finished Scans button on any tool node to open individual scans from that step.

​

Scans and reports

Each robot run appears as a single entry on the Scans page. The individual tool scans that run in the background are hidden from the list. When all tools finish and you have email notifications configured, you get one email notification with an aggregated PDF report attached. The report is also saved to the Reports page. Configure notification rules on the Notifications page. Deleting a robot run from the Scans page removes the entire run and all its child scans. No warning is shown before this happens.

​

Example use cases

​

Sharing robots

You can share robots with team members. Shared robots appear alongside default robots so they can run them on their own targets.

​

Permission levels

​

How to share robots

1. Go to Team in the sidebar
2. Select the team members you want to configure sharing for
3. Click Share
4. Set the Robots permission level
5. Click Save

For more on team management and sharing, see Teams and roles.

​

Best practices

​

Related topics

• Scheduled scans
• Scan groups
• Scan types and depth
• Assets and limits
• Attack surface
• Teams and roles