A pentest, not a vulnerability scan

A vulnerability scanner runs a fixed list of checks and stops when the list is done. syslifters.ai works like a human penetration tester: agents explore the application, follow leads, chain issues together and dig deeper where something looks promising. That kind of testing might have no natural end.

A run is a time box

Treat every project as a time box, the same way you would budget a fixed number of days for a manual pentest.

• A run might complete on its own once every planned test has been done.
• A run might not complete within the time you have. New surface found during testing creates new work, and difficult areas can take long.
• When your time is up, end the run with Stop hunting. Testing stops, but the findings that already exist are still verified and reported. See Safety controls.

A project that ends with the status completed with gaps is a normal result. It means some planned tests were skipped, usually because hunting was stopped. The Coverage tab shows which tests ran and which did not.

Keep the scope focused

Every run starts with recon, which maps the application before any vulnerability testing begins. Recon time grows with the size of the target. A very large project (many hosts, many applications or a huge application) can spend a large part of the time box on recon alone, which leaves less time for actual testing.

To get the most out of the time box:

• Put only the systems you really want tested into scope.
• Split large or unrelated targets into several projects instead of one big project.
• Give complete, precise seed URLs so recon finds the relevant parts quickly. See Scope.
• Provide test accounts for every role, especially administrators, so agents can test the administrative functionality instead of guessing at it. See Test accounts.

No guarantee of completeness

Like any penetration test, a run shows the vulnerabilities that were found within the time box. It does not prove that the application has no other vulnerabilities.

Checklist

• I have decided how much time this project gets and will use Stop hunting when it is over.
• The scope contains only what needs to be tested; large targets are split into several projects.
• I understand that "completed with gaps" is a normal outcome and that a run does not prove the absence of vulnerabilities.