---
url: https://docs.syslifters.ai/getting-started/pentest-not-a-scan.md
description: >-
  Why a syslifters.ai run is a time-boxed penetration test and not a scan that
  always finishes.
---

# A pentest, not a vulnerability scan

A vulnerability scanner runs a fixed list of checks and stops when the list is done. syslifters.ai works like a human penetration tester: agents explore the application, follow leads, chain issues together and dig deeper where something looks promising. That kind of testing might have no natural end.

## A run is a time box

Treat every project as a time box, the same way you would budget a fixed number of days for a manual pentest.

* A run **might complete** on its own once every planned test has been done.
* A run **might not complete** within the time you have. New surface found during testing creates new work, and difficult areas can take long.
* When your time is up, end the run with **Stop hunting**. Testing stops, but the findings that already exist are still verified and reported. See [Safety controls](/getting-started/safety-controls#stop-hunting).

A project that ends with the status **completed with gaps** is a normal result. It means some planned tests were skipped, usually because hunting was stopped. The **Coverage** tab shows which tests ran and which did not.

## Keep the scope focused

Every run starts with recon, which maps the application before any vulnerability testing begins. Recon time grows with the size of the target. A very large project (many hosts, many applications or a huge application) can spend a large part of the time box on recon alone, which leaves less time for actual testing.

To get the most out of the time box:

* Put only the systems you really want tested into scope.
* Split large or unrelated targets into several projects instead of one big project.
* Give complete, precise seed URLs so recon finds the relevant parts quickly. See [Scope](/legal/scope#seed-urls).
* Provide test accounts for every role, especially administrators, so agents can test the administrative functionality instead of guessing at it. See [Test accounts](/getting-started/test-accounts#test-accounts).

## No guarantee of completeness

Like any penetration test, a run shows the vulnerabilities that were found within the time box. It does not prove that the application has no other vulnerabilities.

## Checklist

* \[ ] I have decided how much time this project gets and will use **Stop hunting** when it is over.
* \[ ] The scope contains only what needs to be tested; large targets are split into several projects.
* \[ ] I understand that "completed with gaps" is a normal outcome and that a run does not prove the absence of vulnerabilities.