Question 1

What is Scryn?

Accepted Answer

Scryn is a cloud-based security testing platform that helps you identify vulnerabilities in your web applications and APIs. It provides automated security scanning using industry-standard testing methods to detect OWASP Top 10 vulnerabilities and more. Scryn uses DAST (Dynamic Application Security Testing), which tests applications in their running state to identify security vulnerabilities. Scryn is built on top of OWASP ZAP, the world's most widely used web application security scanner, providing you with enterprise-grade security testing capabilities in the cloud. Key benefits of Scryn include: no infrastructure to set up or maintain (fully managed cloud service), quick setup in minutes, intuitive web interface, scheduled automated scans, team collaboration features, comprehensive reporting with multiple export formats (JSON, CSV, PDF), RESTful API for programmatic access, CI/CD integration capabilities, real-time monitoring and notifications, support for complex authentication flows (OAuth, SAML, multi-step), and a 14-day free trial with no credit card required.

Question 2

How do I get started?

Accepted Answer

Getting started is easy! Simply create a free account, add your target URL, and start your first scan. No credit card required. You can begin scanning in minutes.

Question 3

Do I need security expertise to use Scryn?

Accepted Answer

No, you don't need security expertise. Scryn is designed to be user-friendly with an intuitive dashboard. However, understanding the results and implementing fixes may require some technical knowledge or collaboration with your development team.

Question 4

Is there a free trial?

Accepted Answer

Yes! Scryn offers a 14-day free trial with 5 scans per month and 1 AI Agentic scan. Create an account and begin scanning immediately. No credit card required.

Question 5

What types of scans does Scryn support?

Accepted Answer

Scryn supports multiple scan types: Spider Scan (discovers URLs and endpoints), Baseline Scan (passive vulnerability detection), Full Scan (comprehensive active testing), API Scan (tests APIs using OpenAPI/Swagger specifications), GraphQL Scan (imports your GraphQL schema via introspection or URL, then runs active security testing on your GraphQL API), and AI Agentic Scan (an AI agent that explores your app, reasons over responses, and probes for XSS, SQLi, misconfigurations, and security headers—good as a supplement to ZAP for a quick adaptive pass). You can choose the scan type that best fits your needs and risk tolerance.

Question 6

What is AI Agentic Scan?

Accepted Answer

AI Agentic Scan is a scan type powered by Google Gemini. An AI agent explores your application by requesting pages, following links, and probing for common vulnerabilities (e.g. XSS, SQL injection, misconfigurations, sensitive data exposure, security headers). It reasons over each response to decide what to try next—so it can spot issues that depend on interpreting behavior or error messages, not just fixed payloads. That makes it good for a quick adaptive pass, trying high-value paths (e.g. /admin, /api), and as a supplement to ZAP: ZAP gives deep, exhaustive rule-based coverage; the AI agent adds a different perspective and exploratory depth. It's included in your plan with a separate monthly quota (e.g. 1 on trial, 5 on Starter, 20 on Professional). Authenticated scans are supported with the same auth profiles as other scan types.

Question 7

How long does a scan take?

Accepted Answer

Scan duration depends on the size and complexity of your application. A simple spider scan might take a few minutes, while a full scan of a large application could take an hour or more. You can monitor scan progress in real-time through the dashboard.

Question 8

What vulnerabilities does Scryn detect?

Accepted Answer

Scryn detects a wide range of vulnerabilities including SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), authentication flaws, security misconfigurations, sensitive data exposure, and more. It covers the OWASP Top 10 and many additional security issues.

Question 9

Can I schedule scans automatically?

Accepted Answer

Yes! Scryn supports scheduled scans. You can set up daily, weekly, monthly, or custom cron schedules to automatically scan your applications. This helps you catch vulnerabilities as they're introduced.

Question 10

What authentication methods are supported?

Accepted Answer

Scryn supports multiple authentication methods: script-based authentication (for OAuth, SAML, multi-step flows), cookie-based authentication, header-based authentication, HTTP Basic, and OAuth client credentials. Use our Scryn Auth Recorder (downloadable from the dashboard) to capture complex authentication flows.

Question 11

Where do I download the authentication recorder?

Accepted Answer

In your dashboard, go to Config → Authentication Profiles. When creating or editing an auth profile, you'll see an option to download the Scryn Auth Recorder—a Windows application that captures your login flow in a real browser and sends it securely to Scryn. You need an API token (from Config → API Tokens) to run the recorder. The recorder is also used for script-based authentication (OAuth, SAML, multi-step logins).

Question 12

Can I scan applications on private networks?

Accepted Answer

Yes! Scryn offers scan agents that you can deploy on your internal network. Agents run scans locally and submit results back to the cloud platform. You can run both unauthenticated and authenticated scans on agents (same auth profiles as cloud). This allows you to scan applications behind firewalls, on private IPs, VPN-only access, or in air-gapped environments. Agents are available as a public Docker image (no Docker Hub account to pull; Scryn Dashboard required to get agent token and run), Kubernetes/Helm chart, or Windows services. Public URLs can be scanned directly from the cloud without an agent.

Question 13

Do I need a Docker Hub account to run the scan agent?

Accepted Answer

No. The Scryn scan agent Docker image is public on Docker Hub (scryncloud/scan_agent). You can pull it without a Docker Hub account. To run the agent you need a Scryn account and an agent token from the Scryn Dashboard (Agents → Add Agent). For Kubernetes, a Helm chart is also available; no image pull secret is required for the public image.

Question 14

How do I set up and manage scan agents?

Accepted Answer

Go to Config → Scan Agents in your dashboard. Create a new agent to get an agent token. Deploy the Scryn agent using the public Docker image (no Docker Hub account to pull; agent token from dashboard required to run), Kubernetes/Helm, or the Windows service on a machine that can reach your internal applications, and configure it with your agent token. The agent will appear in the dashboard when it connects. You can then run scans that use that agent to test private or internal URLs, including authenticated scans. Agent documentation and download links are available in the dashboard.

Question 15

What technology does Scryn use for scanning?

Accepted Answer

Scryn is built on OWASP ZAP (Zed Attack Proxy), the industry-leading open-source web application security scanner. We leverage ZAP's vulnerability detection engine and extend it with add-ons such as Passive Scan Rules Beta, Active Scan Rules Beta, and GraphQL Support for broader coverage. For authentication flows that require browser interaction, we use Selenium WebDriver to automate real browser sessions, allowing us to handle complex authentication scenarios like OAuth, SAML, and multi-step login processes. In addition, Scryn offers AI Agentic Scan—powered by Google Gemini—where an AI agent explores your app, reasons over responses, and tests for common issues (XSS, SQLi, headers, misconfigurations). It complements ZAP by adding an adaptive, exploratory pass alongside ZAP's deep rule-based coverage, and is included in your plan with a separate monthly quota. Scryn improves upon OWASP ZAP by providing a cloud-based, managed service that eliminates the need to set up and maintain your own ZAP infrastructure. We handle scaling, updates, and infrastructure management, while providing an intuitive web interface, scheduled scans, team collaboration features, comprehensive reporting, and API access that make security testing accessible to teams of all sizes.

Question 16

Is my data secure?

Accepted Answer

Yes, security is our top priority. All sensitive data is encrypted at rest using industry-standard encryption. Data in transit is protected with TLS/SSL. We follow security best practices and maintain strict access controls.

Question 17

How are my credentials stored?

Accepted Answer

Credentials are encrypted before storage. We use variable placeholders (like {{username}} and {{password}}) that you can update without recreating authentication profiles. Credentials are never stored in plain text.

Question 18

Is my scan data private?

Accepted Answer

Absolutely. Your scan data is completely isolated by organization. Each organization's data is separate and secure. We never share your data with third parties.

Question 19

What happens to my scan results?

Accepted Answer

Your scan results are stored securely in your account and are only accessible to members of your organization. You can export results in JSON, CSV, or PDF formats. Results are retained according to your organization's settings.

Question 20

How much does Scryn cost?

Accepted Answer

Scryn offers flexible pricing plans starting with a free 14-day trial that includes 5 scans per month and 1 AI Agentic scan. Paid plans start at $59/month for the Starter plan (50 scans/month, 5 AI Agentic scans/month) and $159/month for the Professional plan (200 scans/month, 20 AI Agentic scans/month). Enterprise plans with custom features and unlimited scans (including unlimited AI Agentic scans) are also available. For detailed pricing information, visit our pricing page or contact our sales team at sales@scryn.cloud.

Question 21

Do you offer enterprise plans?

Accepted Answer

Yes, we offer enterprise plans with custom features, dedicated support, and volume pricing. Contact our sales team to discuss your specific needs and get a customized quote.

Question 22

Can I cancel my subscription anytime?

Accepted Answer

Yes, you can cancel your subscription at any time. There are no long-term contracts or cancellation fees.

Question 23

What kind of support do you provide?

Accepted Answer

We provide email support for all users. Enterprise customers receive priority support with faster response times. Our support team can help with technical questions, account issues, and best practices.

Question 24

How quickly do you respond to support requests?

Accepted Answer

We typically respond within 24 hours during business days. Enterprise customers receive priority support with faster response times. For urgent matters, please mark your request as urgent.

Question 25

Do you have API documentation?

Accepted Answer

Yes, Scryn has a comprehensive REST API. API documentation is available in your dashboard when you're logged in. The API allows you to integrate Scryn into your CI/CD pipeline and custom workflows.

Question 26

Can I integrate Scryn with my CI/CD pipeline?

Accepted Answer

Yes! Scryn provides a REST API that allows you to integrate security scanning into your CI/CD pipeline. You can trigger scans, retrieve results, and export reports programmatically. Create API tokens from the dashboard to authenticate your CI/CD workflows. See the documentation in your dashboard for detailed integration examples for GitHub Actions, GitLab CI, Jenkins, and Azure DevOps.

Question 27

How do I manage API tokens?

Accepted Answer

API tokens are managed from the Config → API Tokens section in your dashboard. You can create tokens with specific permissions (create scans, read scans, read alerts, etc.), set expiration dates, enable/disable tokens, and delete them when no longer needed. Tokens are shared across your organization, so team members can collaborate on CI/CD pipelines. Remember to copy tokens immediately after creation as they're only shown once.

Question 28

How do I set up webhooks?

Accepted Answer

Organization owners and admins can configure webhooks from Config → Webhooks in the dashboard. Add your endpoint URL and choose which events to receive: scan created, started, completed, failed, or cancelled; alert found or high-severity alert; subscription limit reached or expired. You can use Slack, Microsoft Teams, or any custom HTTP endpoint. Webhooks send a JSON payload with event details so you can integrate Scryn with your notification and workflow tools.

Question 29

Do I need to whitelist any IP addresses for cloud scans?

Accepted Answer

If your application is behind a firewall and you want to allow cloud-based scans, you may need to whitelist the ZAP job public IP address. The specific IP address is available in the documentation section of your dashboard. Add this IP to your firewall rules to ensure scans can complete successfully. For applications on private networks, use scan agents instead of cloud scanning.

Question 30

Why do I need authentication methods?

Accepted Answer

Scryn supports both unauthenticated scans (for public-facing applications) and authenticated scans (for protected areas). For authenticated scans, Scryn needs to authenticate to your application to access protected endpoints and test them for vulnerabilities. This is why we support multiple authentication methods - to handle different login flows your application might use.

Question 31

How does the browser recorder work?

Accepted Answer

The browser recorder is a local application that captures your authentication flow. It records cookies, headers, network requests, and browser storage as you log in. This data is then used to create authentication profiles for your scans.

Question 32

Do I need to install anything?

Accepted Answer

Yes, you'll need to download and run the ScrynAuthRecorder.exe application on your local machine. It's a standalone executable that doesn't require installation. The recorder captures your authentication flow and sends it securely to Scryn.

Question 33

What authentication flows are supported?

Accepted Answer

Scryn supports OAuth, SAML, multi-step authentication, form-based login, and more. The browser recorder can capture complex authentication flows including redirects, token exchanges, and multi-factor authentication steps.

Question 34

How do credential variables work?

Accepted Answer

Credential variables allow you to use placeholders like {{username}} and {{password}} in your authentication profiles. You can update the actual credentials without recreating the profile. This is perfect for rotating credentials or using different credentials across environments.

Question 35

Does Scryn support token refresh?

Accepted Answer

Yes! Scryn automatically detects when tokens expire during scans and can refresh them using refresh tokens. The system detects refresh token endpoints from your authentication flow and handles token renewal seamlessly.

Question 36

What report formats are available?

Accepted Answer

You can export scan results in JSON, CSV, or PDF formats. JSON is ideal for programmatic processing, CSV for spreadsheet analysis, and PDF for sharing with stakeholders.

Question 37

What information is included in reports?

Accepted Answer

Reports include vulnerability details, risk levels, confidence scores, descriptions, mitigation steps, CWE/WASC references, evidence (request/response data), and alert instances. PDF reports are formatted for easy reading and sharing.

Question 38

Can I share reports with my team?

Accepted Answer

Yes, you can export reports and share them with your team, stakeholders, or integrate them into your existing tools. Reports can be downloaded from the scan details page.

Question 39

How do I invite team members to my organization?

Accepted Answer

Organization owners can invite team members by going to Organization → Invitations in the dashboard. Enter the email address, select a role (Owner or Member), and send the invitation. The invited user will receive an email with instructions to join. You can manage invitations, resend them, or cancel pending invitations.

Question 40

What are the different user roles?

Accepted Answer

Scryn has two organization roles: Owner (full access including member management, organization settings, and the ability to delete scans and resources) and Member (can create scans and view results but cannot manage configuration or delete scans). Organization owners can assign these roles to users in their organization.

Question 41

How does organization data isolation work?

Accepted Answer

All scans, targets, authentication profiles, and other resources belong to your organization. Each organization's data is completely separate and secure. Only members of your organization can access your organization's data. This ensures proper data isolation and security.

Question 42

What is domain verification?

Accepted Answer

Domain verification allows you to prove ownership of a domain by adding a DNS TXT record. This enables enhanced security features and can be used for compliance requirements. Organization owners can verify domains from Organization → Domain Verification. After adding the DNS TXT record provided by Scryn, click 'Check Verification' to confirm domain ownership.

How Can We Help You?

Getting Started

Scanning & Features

Security & Privacy

Pricing & Plans

Technical Support

Authentication & Recording

Reports & Exports

Organization & Team

Still Have Questions?