Deep Dive Pentest

Deep dive is our most advanced testing mode. It investigates application behavior, access controls, and connected attack paths to uncover complex vulnerabilities within your authorized scope.

What it investigates

Some security weaknesses depend on how features, permissions, and application workflows interact. This mode explores those relationships and investigates how individual weaknesses could combine into a larger security impact.

Area	What the assessment explores
Application workflows	How multi-step processes handle unexpected actions, inputs, and changes in state
Access boundaries	Whether users can reach data or actions outside their intended role or tenant
Authentication and sessions	How sign-in, account recovery, and session controls protect application access
Connected attack paths	Whether one weakness enables further access or a more serious impact
Source-assisted investigation	How attached repository context helps explain application behavior and potential vulnerabilities

The assessment stays within your saved target and scope. Available test accounts, documentation, and source context determine which areas CloudThinker can investigate.

When to use it

Choose this mode when you need a deeper understanding of an application’s security, particularly for:

Applications with several user roles or tenants.
Business workflows where multiple actions affect permissions, data, or transactions.
Important application changes that warrant a detailed assessment.
Findings that suggest a broader attack path or need further investigation.

Allow more time and credits for the assessment. Duration depends on the application, available access, and evidence discovered.

This mode includes destructive testing and can change or delete data within your saved scope. Use an appropriate test environment and review the boundaries before launching.

Prepare the application

Start with a registered Pentest app, verified ownership, and permission to run scans in your workspace.

Prepare	Guidance
Scope	Define the application paths you authorize and exclude areas that must remain off-limits
Test accounts	Provide dedicated identities with clear role and tenant descriptions so expected access can be assessed
Application context	Attach relevant API documentation, workflow descriptions, and repository context when available
Test data	Use disposable data where possible and arrange recovery for data the assessment could change

Saved credentials do not confirm authenticated access. Review the run’s authentication results before treating protected areas as assessed.

Start the assessment

Open your app

Open the app in Cyber → Pentest, or Cyber → Overview when the app list appears there. Review its scope and access in Settings.

Choose the testing mode

Click Run pentest and select Deep dive under Testing intensity. For a new app, select it on the setup wizard’s Start step.For a manual run, you can optionally set Credit limit · Optional. Leave it blank for no per-run limit.

Review and launch

Review the target and destructive-testing warning, then confirm with Run Deep dive.Success state: the workbench opens with the run’s progress and findings.

A credit limit helps control testing spend but is not a hard spending cap. Completing work already in progress and preparing the report can take final usage above it. Clear an entered limit before scheduling.

Understand the results

Follow progress in the workbench, then review the evidence, impact, and remediation guidance for each finding. Focus on the demonstrated application behavior and the access required to reproduce it. Read authentication results and coverage limitations alongside the findings. Missing access, blocked areas, and incomplete checks limit the assessment; a run with no findings does not establish that an application is secure. Use Findings to prioritize remediation and request retesting after fixes. Use Reports to share the assessment and its limitations.

Review

Optimize

Resolve

Cyber

Skills

Artifacts & Dashboards

What it investigates

When to use it

Prepare the application

Start the assessment

Understand the results

Next steps

Triage security findings

Create Cyber reports

​What it investigates

​When to use it

​Prepare the application

​Start the assessment

​Understand the results

​Next steps

Triage security findings

Create Cyber reports

What it investigates

When to use it

Prepare the application

Start the assessment

Understand the results

Next steps