Skip to main content
Assessments are designed for broad, autonomous penetration testing of a configured target. Coverage depends on the target’s scope, available access, and the scenarios investigated during the run. For directed security work, see Agents.

​
Start an Assessment

  1. Click New Assessment.
  2. Select target.
  3. Choose Black-Box or White-Box when available.
  4. Optionally select stored credentials.
  5. Configure scheduling.
  6. Select assessment method.
  7. Start assessment.
Choose Black-Box for external testing. Choose White-Box to include source-code analysis; link a repository to the target before selecting it. Network targets support Black-Box testing only.

​
Assessment Methods

When creating an assessment, choose a method based on your needs:
  • Balanced — Designed for frequent runs. Uses 200 credits, with an estimated runtime of 6 hours.
  • Deep — More time for investigation. Uses 400 credits, with an estimated runtime of 8 hours.
  • Ultra — Extended testing for deeper investigation. Uses 800 credits, with an estimated runtime of 12 hours.
The assessment form shows the current credit cost and estimated duration before you start. Actual run times vary with the target and execution conditions.
The public API uses the method values balanced, deep, and ultra, which map to the dashboard labels Balanced, Deep, and Ultra.

​
Assessment Use Cases

Use assessments to investigate potential vulnerabilities and review any findings with supporting evidence. Assessments are the broad discovery workflow. Use Agents for narrower follow-up investigations, and use Patching or MCP when you are ready to remediate.

​
Monitor Progress

In Assessments, track:
  • active and queued runs
  • scheduled runs
  • historical runs
Open an assessment to review progress and evidence entries as they populate. You can also list assessments from the public API. It supports cursor pagination and filters for target, assessment type, method, and status:
Supported assessment type filters are black-box and white-box. White-box assessments include code assessment; black-box assessments do not. Supported status filters are active, completed, failed, and canceled.

​
Scheduling

You can create recurring schedules directly from the New Assessment modal. Frequency options include:
  • one-time
  • daily
  • weekly
  • bi-weekly
  • monthly
For a one-time run, start immediately or schedule it for later. Set the target, optional credentials, frequency, date/time, and timezone when creating a schedule. In Scheduled Assessments, you can review and delete existing schedules.

​
Manage schedules through MCP

MCP supports listing, inspecting, creating, updating, pausing, resuming, deleting, and triggering assessment schedules. Start with list_assessment_schedules and use the returned schedule ID for subsequent actions.
  • Pausing stops future scheduled runs without canceling assessments already created.
  • Resuming uses the saved cadence and configuration.
  • Triggering an enabled schedule requests a run without changing its cadence.
  • Deleting a schedule stops future runs; existing assessments remain available.
Multiple schedules can share a target when their occurrences are at least five minutes apart. Assessments for the same target run one at a time; additional runs wait in the queue and start automatically. See the MCP tool catalog.

​
Dual Credential Mode

For authenticated assessments, enable Dual credential mode when you want MindFort to test access-control boundaries between two stored accounts. Dual credential mode uses:
  • a primary credential for the first account
  • a secondary credential for the alternate account
Use it to test issues such as IDOR, role bypass, and cross-user access. Add at least two stored credentials to the target before enabling dual credential mode.

​
Cancel a Running Assessment

  1. Open Assessments.
  2. Find the active run.
  3. Click cancel and confirm.
You can also cancel a running assessment from the public API:

​
Evidence

Open a completed assessment to view the Assessment Log. The log shows timestamped evidence rows with the endpoint and notes captured during the run. Assessment log entries older than 30 days are automatically cleared.

​
Review coverage after a run

Open Coverage to inspect tested scenarios, incomplete work, and linked findings. Review Analytics for trends across runs. Scheduling is available on all plans; a scheduled run still needs a ready target and sufficient credits or applicable usage-based billing.
Last modified on October 28, 2026