TigerStrike’s agent is instruction-driven: everything you set in a scan config is compiled into one natural-language instruction the agent plans against. Get that instruction right and the scan is faster, cheaper, and finds more.
Configure a scan at Pentest → New Scan. The form walks: name → target → target type → scan mode → budget → focus areas / modules → instruction → an effective-instruction preview → launch.
Target type
The target type sets the agent’s default playbook.
| Type | Target | What the agent does |
|---|
| Web | App URL (https://app.example.com) | Browser / HTTP pentest — XSS, SSRF, IDOR, path traversal, auth. |
| API | API base URL | REST / GraphQL / SOAP — auth, authz, injection, BOLA, fuzzing. |
| Network | CIDR / IP range (10.20.0.0/24) | Port enumeration + per-service safe checks (nmap + masscan). Non-destructive; stays inside the CIDR. |
Web, API, and Network are wired end-to-end today. More target types (Kubernetes, Cloud, LLM/AI, OAuth, Fintech) are staged in the engine and appear here as they ship.
Scan mode & budget
| Setting | Options | Notes |
|---|
| Scan mode | Quick (~10 min, shallow) · Standard (~30–60 min, default) · Deep (longest, exhaustive) | Wall-clock depth. |
| Budget (USD) | per your org default | Hard cap on LLM spend for one run — the scan stops when it’s reached. See Budgets & spend. |
Focus areas & modules
These bias the agent’s planner toward the classes you care about — each adds a short “also specifically check for X” line to the instruction. They tilt the scan; they don’t restrict it.
- Focus areas (presets): Auth · GraphQL · Session · Token · Business logic.
- Modules (Web / API, granular): Injection · XSS · SSRF · IDOR · BOLA · Deserialization · Recon · Auth bypass · XXE · Path traversal · Command injection · Open redirect · Mass assignment · Broken auth.
Leave them empty for a broad scan; add a few when you want depth on specific classes.
The instruction
This is the highest-leverage field. Your free-text instruction is combined with the rest of the config into the single string the agent plans against:
[ target-type preamble ] automatic — only Network adds one; Web / API pass straight through
[ focus-area lines ] automatic — from the Focus areas / Modules you picked
[ auth details ] automatic — from the login / credentials you enter
[ your instruction ] your free text — gets the last word
Writing good instructions
The agent is only as focused as you make it. A good instruction reads like a short brief to a human pentester.
Do:
- Give it a way in. Auth is the number-one blocker. “Log in at
/login with [email protected] / <password>, then test everything behind the dashboard.”
- Point at what matters. “Prioritise
/api/v1/payments and /api/v1/transfers — money movement is the crown jewel.”
- Encode business rules. “A
viewer role must never reach /admin/* or mutate another tenant’s data — hunt for that.”
- Set guardrails. “Do NOT touch
/export — it emails real customers. Keep to ~5 requests/second.”
- Name the stack when you know it. “Rails + GraphQL behind Cloudflare; the session cookie is
_acme_session.”
Don’t:
- Restate what the target type already covers (“do a web pentest”) — that’s implied.
- Paste a whole scope document — a few sharp sentences beat a wall of text.
- Contradict your focus areas — they’re already in the instruction.
Examples
Web app with auth:
Log in at /login with [email protected] / <password>. Focus on the /admin panel and
multi-tenant isolation — a customer must never read or write another customer's
records. The session cookie is _acme_session. Do not hit /billing/export.
REST API at /v1. Auth is a Bearer JWT from POST /v1/auth/login. Hammer /v1/users
and /v1/orders for BOLA/IDOR across the two seeded accounts (ids 1001 and 1002).
Check the profile-update endpoint for mass assignment.
Scan 10.20.0.0/24. Priority hosts are 10.20.0.10-12 (the app tier). Flag any
management ports (SSH / RDP / database) reachable from outside the subnet. Read-only.
Save & reuse
A config can be saved and paired with any target, then run manually or on a schedule. See Targets & scan configs for the create / run / schedule mechanics, and Findings for triage. 
