Running an Assessment¶
Audience: Client owners and managers (creating/launching a test spends license
capacity, so basic members/viewers can browse assessments but not start one) · Where:
Assessments in the sidebar (/assessments).
Overview¶
An assessment (also called a project or engagement) is a single penetration test or scan against a target you own. The Assessments page lists all of them and is where you launch a new one. Canima organises assessments under three pillars:
-
Web Application
Authenticated/unauthenticated testing of a web app, API, or LLM endpoint.
-
Internal Network
A test from inside your network perimeter.
-
External Network
An internet-facing infrastructure test.
Each pillar offers one or more templates — for example a full pentest, a vulnerability scan, or an Active Directory audit — and you start an assessment by picking the template that matches what you want done.
The Assessments list¶
The page opens on a table of every assessment with its Type, Status (e.g. Completed, In Progress, Scheduled), a Severity summary of its findings, the Target, and the Created on date. Summary tiles at the top count Total / Scheduled / In Progress / Completed.
Narrowing the list
Use the Display filter (All / Active / Scheduled / Closed), the All Types dropdown, or the search box to narrow the list. Export downloads the list. Click any row to open that assessment.
Creating an assessment¶
Click Create Assessment (top right). Instead of a pop-up wizard, this now opens a full-page flow: first a template gallery, then a configuration page for the template you pick.
Step 1 — Pick a template¶
The gallery groups templates under their pillar (Internal Network, External Network, Web Application). The templates available today are:
Internal Network¶
-
Internal Pentest
Full attack-path pentest from inside the perimeter.
-
Internal Vulnerability Scan
Authenticated/unauthenticated vuln scan, no exploitation.
-
Active Directory Audit
Read-only misconfiguration audit of AD (Kerberos, ACLs, delegation).
External Network¶
-
External Pentest
Internet-facing infrastructure pentest with OSINT.
-
External Vulnerability Scan
Perimeter vuln scan across discovered hosts, no exploitation.
Web Application¶
-
Web App Pentest
Authenticated/unauthenticated application security test.
A card is locked (greyed with a padlock) when you can't start it right now. The badge tells you why:
| Badge | Why the card is locked |
|---|---|
| No active license | Your organisation doesn't hold a license for that pillar. |
| Managers only | You're a member/viewer, not an owner or manager. |
| Coming soon | A template that isn't buildable yet. |
Vulnerability-scan templates
Vulnerability-scan templates check your organisation's vulnerability-scan license rather than the full-pillar license. Picking an available card takes you to its configuration page.
Step 2 — Configure the assessment¶
The configuration page has a set of sections you work through down the left side. For most templates these are Scope → Config → Credentials → Schedule. (The Active Directory Audit is a read-only audit with no engagement options, so it skips Config.)
Scope — give the assessment a name and define the target:
Pick the primary target application from your Asset Library (the picker lists the URLs, domains, and API endpoints you've registered — "Don't see your app? Add it first" links to the Asset Library). You can add additional in-scope applications and select scope tag groups to widen the surface.
Enter the target hosts and IP ranges (or select scope tag groups / registered assets), and choose the OVA appliance that will run the scan. The Active Directory Audit additionally takes the Domain Controller to bind to.
Enter the target domain (the OSINT anchor) and any additional in-scope hosts.
Config — the rules of engagement and testing options for the template. For a Web App Pentest you choose one or more Application types (SaaS / B2B, Marketing site, REST/GraphQL API, LLM agent, Chatbot) — these drive which testing agents run — and toggle:
| Toggle | Note |
|---|---|
Authenticated testing |
|
Brute-force allowed |
Destructive |
Post-exploitation allowed |
Destructive |
Disruptive testing allowed |
Destructive |
Whitelist against WAF |
|
Source code review |
Internal and external pentests expose their own toggles and an Advanced scan settings block (for example Active Directory attack options, or Skip OSINT collection for an external engagement). Vulnerability-scan templates run a scan and report only, so they present fewer options.
Credentials — optionally attach credentials the test should use (for authenticated scanning or pentesting). You can reference a credential from your Credential Vault or enter one inline, and mark whether it's for vulnerability scanning, pentesting, or both. Credentials are optional.
Schedule — choose when it runs:
- Run now — start immediately after creation.
- Schedule for later — pick a future date/time for a single scan.
- Recurring — the first scan starts now; subsequent runs each spawn a new assessment on a
cadence (Daily / Weekly / Bi-weekly / Monthly / Quarterly, at fixed UTC times). Each
recurrence creates a new assessment named
<name> #N, and each clone counts toward your license caps.
Click Create Assessment to launch, or Cancel to discard.
Note on \"Whitelist against WAF\"
When enabled for a web-app engagement, Canima generates a browser-like User-Agent for the scan so you can allowlist its traffic through your web application firewall. After creation, the exact string to whitelist is shown on the assessment's Overview tab.
Rules of Engagement (RoE)¶
Attestation required for external and web-app engagements
For external and web-app engagements, clicking Create Assessment opens a Rules of Engagement attestation — a short legal confirmation that you're authorised to test the target, scoped to that engagement's legal text. Read it and accept to let the engagement proceed. This protects both you and Canima.
Internal engagements apply their rules of engagement through the Scope/Config options you set rather than a separate modal.
Tips¶
- Only managers and owners can submit an assessment, because launching one consumes license capacity from your organization's allocation. See Licenses & Credits.
- The target you pick must already exist in your Asset Library. If it isn't there yet, add it first — see Asset Library.
- Leave the destructive toggles (Brute-force, Disruptive testing, Post-exploitation) off unless you understand and accept the risk to the target.
- Choose a Vulnerability Scan template when you want coverage without exploitation; choose a Pentest template when you want the agents to actually prove and chain issues.
Related: Assessment Overview · Findings · Asset Library · Licenses & Credits