Running an Assessment¶

Audience: Client owners and managers (creating/launching a test spends license capacity, so basic members/viewers can browse assessments but not start one) · Where: Assessments in the sidebar (/assessments).

Overview¶

An assessment (also called a project or engagement) is a single penetration test or scan against a target you own. The Assessments page lists all of them and is where you launch a new one. Canima organises assessments under three pillars:

Web Application

Authenticated/unauthenticated testing of a web app, API, or LLM endpoint.
Internal Network

A test from inside your network perimeter.
External Network

An internet-facing infrastructure test.

Each pillar offers one or more templates (for example a full pentest, a vulnerability scan, or an Active Directory audit), and you start an assessment by picking the template that matches what you want done.

The Assessments list¶

The page opens on a table of every assessment with its Name, Type, Status (e.g. Completed, In Progress, Scheduled), a Severity summary of its findings, the Target, and when it was Created. Summary tiles at the top count Total / Scheduled / In Progress / Completed; click a tile to filter the list.

Narrowing the list

Use the Display filter (All / Active / Scheduled / Closed), the Type filter, or Search by name or target… to narrow the list. Export the list as CSV from the table toolbar. Click any row to open that assessment.

Folders and archiving¶

A folder rail beside the list helps you organise a long history:

All Assessments shows everything; Unfiled shows assessments not in any folder.
Create your own folders with New folder.
Select rows to act on them in bulk: Move to folder, Archive, or (from the Archived view) Unarchive or Delete.
Archived lists archived assessments across all folders. Archiving hides an assessment from the main list without deleting it.

Creating an assessment¶

Click Create Assessment (top right). This opens a full-page flow: first a template gallery, then a configuration page for the template you pick.

Step 1: Pick a template¶

The gallery groups templates under their pillar (Internal Network, External Network, Web Application). The templates available today are:

Internal Network¶

Internal Pentest

Full attack-path pentest from inside the perimeter.
Internal Vulnerability Scan

Authenticated/unauthenticated vuln scan, no exploitation.
Active Directory Audit

Misconfiguration audit of AD (Kerberos, ACLs, delegation).

External Network¶

External Pentest

Internet-facing infrastructure pentest with OSINT.
External Vulnerability Scan

Perimeter vuln scan across discovered hosts, no exploitation.

Web Application¶

Web App Pentest

Authenticated/unauthenticated application security test.

A card is locked (greyed with a padlock) when you can't start it right now. The badge tells you why:

Badge	Why the card is locked
No active license	Your organisation doesn't hold a license for that pillar.
Managers only	You're a member/viewer, not an owner or manager.
Coming soon	A template that isn't buildable yet.

Vulnerability-scan templates

Vulnerability-scan templates check your organisation's vulnerability-scan license rather than the full-pillar license. Picking an available card takes you to its configuration page.

Step 2: Configure the assessment¶

The configuration page has sections you work through down the left side: Scope → Config → Credentials → Schedule. (The Active Directory Audit has no engagement options, so it skips Config.) Use Next to move on, and Create Assessment on the last section to launch.

Scope¶

Give the assessment an Assessment name, then define the target:

Web App PentestInternal Pentest / Vulnerability ScanActive Directory AuditExternal Pentest / Vulnerability Scan

Target web application: pick the application from your Asset Library. The picker lists the web apps you've registered; if yours isn't there, use Add a web application.
Access method: Canima cloud (for apps reachable from the internet) or Through your OVA (for internal apps; the tests run from your appliance, inside your network, and you pick the OVA appliance). This choice only appears once one of your OVAs has been enabled for web-app testing. See OVA Appliances.
Additional in-scope hosts (optional): further apps from your Asset Library, plus scope tag groups to widen the surface.

OVA appliance (required): the appliance on your network that runs the test.
Scope assets (required): pick internal hosts, IPs, or subnets from your Asset Library, or enter Target CIDRs and Target hosts (optional) manually. You can also select scope tag groups.
AD domain names (optional) and Domain Controller IP, if you want the test to focus on specific Active Directory domains.

Choose the OVA appliance and enter the Domain Controller IP the audit binds to. The audit also needs a domain-user credential (see Credentials below).

Target OSINT Domain: a domain associated with your company, used as the anchor for OSINT. It's required unless you turn on Skip OSINT collection under the advanced settings.
Pick the hosts, domains, and IPs to test from your Asset Library. CNAMEs to third-party hosts are eligible; selecting one adds it to the rules of engagement for this pentest only. If your library is empty, Run ASM discovery takes you to Attack Surface to find assets.
Additional IP addresses and Additional CIDR ranges for addresses that aren't in your Asset Library.
Excluded / blacklisted targets (optional): hosts, IPs, or ranges that must never be touched.

Config¶

The rules of engagement and testing options for the template.

For internal and external templates (except the AD Audit), Config opens with Engagement mode: Full Pentest (recon, exploitation, and a full findings report) or Vulnerability Scan Only (a vulnerability scan and report, no pentest findings; needs a vulnerability-scan license). The template you picked pre-selects it.

Web App PentestInternal Pentest / Vulnerability ScanExternal Pentest / Vulnerability Scan

Choose one or more Application types (SaaS / B2B, Marketing site, REST/GraphQL API, LLM agent, Chatbot); these drive which tests run. Then set:

Option	Note
Authentication handled by a 3rd-party provider?	Name the Provider (for example Okta, Auth0, Cognito, or a custom OIDC provider) and list its In-scope provider hosts so the login flow can be followed.
`Brute-force allowed`	Destructive
`Post-exploitation allowed`	Destructive
`Disruptive testing allowed`	Destructive
`Whitelist against WAF`
`Source code review`	Pick a connected repository and a GitHub writeback mode: Disabled, Preview (queued for an admin to release), or Auto (recommended) (confirmed findings are posted when the report finalizes). See Integrations.
Secondary in-scope targets (optional)	Comma- or newline-separated hosts the scanner may probe if it meets them in the primary target's traffic.

Authenticated testing is set up in the Credentials section as login identities.

Option	What it controls
Port range	Which TCP ports are scanned on every live host: Top 100, Top 1,000 (default), Top 5,000, Top 10,000, All ports (1–65535), or a Custom range such as `22,80,443,8000-9000`. All ports can take many hours on large scopes.
Scan intensity	Stealth, Normal, or Aggressive: sets scan timing, the total packet rate on your network, and service-detection depth. Use Stealth for fragile or legacy segments; Aggressive is faster but more likely to trip IDS alerts.
Enable IPv6 DHCP testing	Off by default. Tests IPv6-based relay and authentication abuse paths; can briefly disrupt networking on IPv6-capable hosts.
Vulnerability scanning	On by default. Runs authenticated / network vulnerability scanning as part of the engagement; turn off for a faster, pentest-only run.

Advanced / loud testing (collapsed, all off by default) holds high-impact techniques that each ask you to confirm: DCSync, ADCS web-enrollment relay, active LLMNR/NBT-NS poisoning, a CVE exploit chain, remote code execution, and lateral persistence. Enable these only on segments where you have explicit written authorization.

Test coverage & tuning (collapsed) lets you switch individual techniques on or off (Active Directory testing, Kerberoasting, NTLM relay, passive responder and credential capture, share & credential hunting, delegation abuse, ACL abuse, Username generation with optional employee-name seeds, password testing, exploitation, lateral movement, privilege escalation) and tune limits such as the lockout threshold, lockout duration, and max password attempts. Keep password limits at or below your lockout policy.

Most options live under Show advanced scan settings:

Option	What it controls
Port range	Same choices as internal; Top 1,000 (default) covers most internet-facing services.
Scan intensity	Stealth, Normal, or Aggressive. Lower intensity is gentler on rate-based detection but takes longer.
OSINT collection depth	Light (emails and subdomains), Standard (adds search-engine dorks and cloud asset enumeration), or Deep (adds code-hosting secrets and public API workspaces).
Skip OSINT collection	Pentest-only engagement: bypass OSINT entirely. The pentest still runs against your selected assets and IPs.
DNS subdomain bruteforce / DNS zone transfer (AXFR)	Wordlist-based subdomain discovery, and an attempt to pull the full zone from your authoritative name servers.
Show raw PII in the report	Off by default, so discovered emails and usernames are masked in the PDF (e.g. `j****@example.com`).
Exploitation & safety limits	Allow reverse shells and Allow denial-of-service testing (both off by default), plus password-testing limits: Max password attempts / account, Account lockout threshold, Account lockout duration.
Microsoft 365 / Azure AD identity testing	Enable M365 / Azure AD testing to permit Azure AD user enumeration and password spraying, limited to the Allowed tenant IDs and Allowed accounts (UPNs) you list.

Below that:

Allow agents to access ASM data: start the test with what Attack Surface monitoring already knows (subdomains, IPs, services).
Include breached credentials: let the test use credentials leaked in known breaches.
Include vulnerability scanning: run a deep vulnerability scan against discovered services.
Test discovered web applications (non-destructive): on by default. Runs application-layer checks (injection, authentication and app-logic) against web apps found during the test. Read-only: no data is dumped and no shells are opened.

Vulnerability-scan templates run a scan and report only, so they present fewer options.

Credentials¶

Optional for most templates; required for the Active Directory Audit.

Web App PentestInternal / External / AD Audit

Login identities (optional): the accounts the scanner signs in as. Add users from different roles or tenants to test whether one can reach another's data. One identity is the primary login used for crawling and general testing. Pick a saved identity from your vault or enter one for this assessment only.

See Web App Authentication for login styles, MFA (TOTP), tokens, and OAuth client credentials.

Attach credentials for authenticated vulnerability scanning and/or pentesting (for an AD Audit, the domain user the audit binds with). Types include SSH (password or key), SMB, ESXi, SNMP, and LDAP / Domain user.

Add a saved credential from your vault, or Add a new credential inline. Tick Save to vault for reuse on other engagements to keep it.
For each credential, choose Use for vulnerability scanning and/or Use for pentesting.

Owners and managers manage saved credentials in Administration → Credentials. Credentials are stored encrypted.

Schedule¶

Choose when the assessment runs.

First run:

Run now: start the first scan immediately after creation.
Start on a date: pick a future date and time for the first scan.
Only on schedule: no immediate run; the first scan is the next recurrence (needs Repeat on a schedule).

Repeat on a schedule: turn this on to make the assessment recurring, then pick a Frequency:

Daily
Weekly on a weekday
Monthly on a day of the month
Monthly on the Nth weekday (for example, the second Tuesday)
Monthly on the last day
Quarterly (Jan/Apr/Jul/Oct)

Set the Hour (UTC) and Minute, or choose Enter a custom cron instead for a 5-field UTC cron expression. Each recurrence creates a new assessment named <name> #N, and each one counts toward your license caps.

Restrict testing to specific hours (external engagements): off by default (testing runs 24/7). Turn it on to set the Allowed days, Window start, Window end, and Timezone; testing pauses outside that window. Use it for production targets that may only be tested in a maintenance window.

Click Create Assessment to launch, or Cancel to discard.

Settings are fixed once the scan starts

Check your configuration before launching. Once the scan has started, the assessment's settings, rules of engagement, and login identities can't be changed. Every assessment has a Config tab with a read-only record of what was set (see Assessment Overview).

Note on \"Whitelist against WAF\"

When enabled for a web-app engagement, Canima generates a browser-like User-Agent for the scan so you can allowlist its traffic through your web application firewall. After creation, the exact string to whitelist is shown on the assessment's Overview tab.

Rules of Engagement (RoE)¶

Attestation required for external and web-app engagements

For external and web-app engagements, clicking Create Assessment opens a Confirm scope authorisation dialog: a short legal confirmation that you're authorised to test the target, scoped to that engagement's legal text. Read it and accept to let the engagement proceed. This protects both you and Canima.

Internal engagements apply their rules of engagement through the Scope/Config options you set rather than a separate dialog.

Tips¶

Only managers and owners can submit an assessment, because launching one consumes license capacity from your organization's allocation. See Licenses & Credits.
The target you pick should already exist in your Asset Library. If it isn't there yet, add it first. See Asset Library.
Leave the destructive and loud options (Brute-force, Disruptive testing, Post-exploitation, reverse shells, denial-of-service, the Advanced / loud testing block) off unless you understand and accept the risk to the target.
Choose a Vulnerability Scan template (or Vulnerability Scan Only mode) when you want coverage without exploitation; choose a Pentest when you want the agents to actually prove and chain issues.