> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deep Dive Pentest

> Explore complex vulnerabilities and connected attack paths with our most advanced application testing mode.

**Deep dive** is our most advanced testing mode. It investigates application behavior, access controls, and connected attack paths to uncover complex vulnerabilities within your authorized scope.

## What it investigates

Some security weaknesses depend on how features, permissions, and application workflows interact. This mode explores those relationships and investigates how individual weaknesses could combine into a larger security impact.

| Area | What the assessment explores |
| - | - |
| Application workflows | How multi-step processes handle unexpected actions, inputs, and changes in state |
| Access boundaries | Whether users can reach data or actions outside their intended role or tenant |
| Authentication and sessions | How sign-in, account recovery, and session controls protect application access |
| Connected attack paths | Whether one weakness enables further access or a more serious impact |
| Source-assisted investigation | How attached repository context helps explain application behavior and potential vulnerabilities |

The assessment stays within your saved target and scope. Available test accounts, documentation, and source context determine which areas CloudThinker can investigate.

## When to use it

Choose this mode when you need a deeper understanding of an application's security, particularly for:

* Applications with several user roles or tenants.
* Business workflows where multiple actions affect permissions, data, or transactions.
* Important application changes that warrant a detailed assessment.
* Findings that suggest a broader attack path or need further investigation.

Allow more time and credits for the assessment. Duration depends on the application, available access, and evidence discovered.

<Warning>
  This mode includes destructive testing and can change or delete data within your saved scope. Use an appropriate test environment and review the boundaries before launching.
</Warning>

## Prepare the application

Start with a [registered Pentest app](/guide/security/pentest), verified ownership, and permission to run scans in your workspace.

| Prepare | Guidance |
| - | - |
| Scope | Define the application paths you authorize and exclude areas that must remain off-limits |
| Test accounts | Provide dedicated identities with clear role and tenant descriptions so expected access can be assessed |
| Application context | Attach relevant API documentation, workflow descriptions, and repository context when available |
| Test data | Use disposable data where possible and arrange recovery for data the assessment could change |

Saved credentials do not confirm authenticated access. Review the run's authentication results before treating protected areas as assessed.

## Start the assessment

<Steps>
  <Step title="Open your app">
    Open the app in **Cyber → Pentest**, or **Cyber → Overview** when the app list appears there. Review its scope and access in **Settings**.
  </Step>

  <Step title="Choose the testing mode">
    Click **Run pentest** and select **Deep dive** under **Testing intensity**. For a new app, select it on the setup wizard's **Start** step.

    For a manual run, you can optionally set **Credit limit · Optional**. Leave it blank for no per-run limit.
  </Step>

  <Step title="Review and launch">
    Review the target and destructive-testing warning, then confirm with **Run Deep dive**.

    **Success state:** the workbench opens with the run's progress and findings.
  </Step>
</Steps>

<Note>
  A credit limit helps control testing spend but is not a hard spending cap. Completing work already in progress and preparing the report can take final usage above it. Clear an entered limit before scheduling.
</Note>

## Understand the results

Follow progress in the workbench, then review the evidence, impact, and remediation guidance for each finding. Focus on the demonstrated application behavior and the access required to reproduce it.

Read authentication results and coverage limitations alongside the findings. Missing access, blocked areas, and incomplete checks limit the assessment; a run with no findings does not establish that an application is secure.

Use [Findings](/guide/security/cyber-findings) to prioritize remediation and request retesting after fixes. Use [Reports](/guide/security/cyber-reports) to share the assessment and its limitations.

## Next steps

<CardGroup cols={2}>
  <Card title="Triage security findings" icon="list-check" href="/guide/security/cyber-findings">
    Review evidence and prioritize remediation
  </Card>

  <Card title="Create Cyber reports" icon="file-lines" href="/guide/security/cyber-reports">
    Share findings and assessment results
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.