How It Works

Understand the AYAsec scan pipeline from target verification through queued jobs, evidence collection, scoring, and reports.

Every scan you queue goes through the same pipeline: it's queued, picked up by a scanner, normalized into findings, scored, and rendered as a report.

1. Queueing

When you start a scan, the API creates a job and hands it to a message queue. Each scan type - TLS, HTTP, Ports, DNS, Credibility, Discovery - has its own dedicated scanner service behind that queue, so a slow Discovery run on one target never blocks a quick TLS check on another.

2. Scanning

The scanner for that type does the actual work: a TLS scan probes the certificate chain and negotiates every protocol/cipher combination; a Ports scan runs TCP/UDP service discovery; an HTTP scan crawls with ZAP and can perform active checks; a DNS scan walks records, DNSSEC, and email authentication; a Credibility scan queries DNSBL, RDAP/WHOIS, abuse and threat-intel sources; a Discovery scan enumerates subdomains and related domains, checks web-port liveness, and can enrich hosts with HTTP and GeoIP metadata. Results that depend on an external lookup (blacklists, threat intel, CVE data) retry automatically on transient failures, so a single flaky upstream API doesn't silently show up as "clean".

3. Normalization

Raw scanner output is parsed into a consistent shape: a list of findings, each with a title, description, remediation guidance, and a severity (critical, high, medium, low, or info). Where a finding maps to a known vulnerability, it carries the CVE/CVSS reference and, for Ports/HTTP/Discovery, an EPSS score and CISA KEV flag so you can prioritize by real-world exploitation likelihood, not just CVSS.

4. Scoring

Each finding deducts points based on its severity. The remaining score maps to a letter grade (A+ through F) for that scan. The target's Overall grade is a weighted average across the five core scan types - see Scoring for the exact weights and thresholds.

Discovery before security scans

Discovery is launched from Assets Discovery and can combine AYAsec enumeration with connected DNS-provider records and an uploaded zone or host list. A review step shows what will be scanned and skips domains that are already active or outside the workspace's verified scope. The resulting assets can then be opened for a normal security scan or organized into an asset group.

Why separate scanners per type

Each scan type is its own horizontally-scaled service. That keeps a slow scan type from starving a fast one under load, lets each scanner retry and cache its own external lookups independently, and means a new scan type can be added without touching the others.