Is a Phylex Scan report equivalent to a penetration test?

No. Phylex Scan is automated scanning that finds common vulnerabilities and misconfigurations. For audits that require manual testing, use the Phylex Pentest service.

Why is a finding I fixed still open?

A finding closes only after the next scan with the same (or broader) profile no longer finds it. Run a retest after your fix is deployed.

Phylex Scan profiles, findings, triage, and reports

When to use Baseline, Standard, or Threat scans; how to read severities, mark false positives, retest fixes, and choose a report format.

Choosing a scan profile

Baseline (all plans, about 45 minutes): ZAP crawls the site and analyzes passively, plus safe Nuclei templates. Suitable for production.
Standard (Pro and up, about 1–2 hours): Baseline plus a ZAP active scan that sends test payloads (XSS, SQL injection, and so on). It can create junk data in forms, so point it at staging.
Threat (Pro and up, about 20 minutes): tests only specific CVEs from the Intel tab. It does not use manual scan quota; up to 4 per asset per month.

Extra checks by plan: TLS & certificates and email security (SPF, DKIM, DMARC, CAA) on all plans; subdomain suggestions from Starter; open ports & services (100 common TCP ports) from Pro. Port checks are skipped automatically for shared CDN or cloud IPs and need consent, because the server IP may belong to your hosting provider.

Reading severities

Critical / High: fix now. The scan email is marked PENTING (important) when Critical/High findings are new or reappear.
Medium: plan a fix in the next sprint.
Low / Info: hardening or inventory information, such as detected technologies.

Every finding has a permanent number per organization (F-001, …), the same in the console, reports, and search. Open a finding to see the URL, parameter, evidence, CWE/OWASP, remediation, and the Phylex Assistant panel: a plain-language explanation reviewed by the Phylex security team, including steps for technologies detected on your asset such as nginx, Apache, Cloudflare, or WordPress.

Triage: false positive and accepted risk

Mark false positive when the finding is not true for your application.
Accept risk when it is true but deliberately not fixed.
Reopen to undo.

Both require a note for the audit trail. A good note: "Hash constant (0x67452301) in the Firebase library, not a server timestamp." Triaged findings stay on record and are labeled in reports.

Retest: confirming a fix

After fixing, run another scan with the same profile. Findings that no longer appear become Fixed automatically. A Baseline scan does not close findings from a Standard scan, and an unauthenticated scan does not close findings only visible when logged in, so "Fixed" is never a false close.

Choosing a report format

PDF: the formal report for management & auditors (executive summary, details, methodology, limitations; marked CONFIDENTIAL).
CSV: a finding list for Excel/Google Sheets or import into Jira.
Markdown: technical notes for developers (tickets, GitHub issues, wikis).
JSON: structured data for integrations & CI.

The trial gets a watermarked PDF only, with full detail for Critical/High. Triage status is computed at download time, and every download is logged.