Scheduled scans

From the Starter plan, every asset can be scanned automatically. Open the asset card in the Assets tab, click Schedule in the Scheduled scan card, choose Monthly (first given weekday of the month), Weekly (day and hour) or Daily (Business plan), and tick the consent box. Times are in WIB (UTC+7); choose off-peak hours. Production sites can be limited per asset in the Scan mode card: Passive (ZAP passive, TLS, DNS/email; no Nuclei, Standard, ports, login or threat scans) or TLS & headers only (one GET request, no crawling).

  • Scheduled scans use the Baseline profile and do not use manual scan quota.
  • Optionally include port checks (Pro and up) and login (if configured).
  • If you move down from Business, daily schedules automatically become weekly.

Notification emails

  • Scan finished: counts per severity and changes since the previous scan. The subject is marked PENTING (important) when Critical/High findings are new or reappear. Emails contain no vulnerability details; open the console for those.
  • Login failed: authenticated scan credentials need updating.
  • RoE verification: approved or rejected, with the reason.
  • Tickets: replies from the Phylex team.
  • Team invites: sent to the invited email.

CVE intel and threat scans

The Intel tab (Pro and up) lists vulnerabilities actively exploited in the wild from the CISA KEV catalog that match technologies detected on your assets. Click Scan this threat to test that CVE (about 20 minutes, up to 4 per asset per month, outside the manual quota). On Business, threat scans run automatically when a new matching CVE appears.

Phylex Assistant

  • Explanations per finding type (all plans): the "Phylex Assistant" panel on a finding explains the meaning, risk, and fix in plain language. Explanations are written and reviewed by the Phylex security team.
  • Ask the Assistant (Pro and up): ask about your findings, such as "what is the business risk", "how do I fix this on nginx", or "what should I fix first". Click the Assistant button at the bottom right (on every console page), or Ask the Assistant about this finding in a finding's detail so the question uses that finding as context. The conversation stays open when you switch pages. Monthly quota: Pro 100, Business 300 questions.

Before anything is sent to the AI model, finding data is masked: hostnames, IPs, full URLs, emails, tokens, and cookies are replaced with markers such as [aset] or [rahasia]. The Assistant only reads your organization's data and cannot run scans or change finding status. Answers are AI-generated, so check them before applying.