Methodology
How OnScanner detects what it reports
OnScanner is a deterministic scanner. Every finding comes from a specific engine, a specific signal, and, where applicable, an authoritative data source. This page explains how detection works, and how the optional AI Findings layer analyzes the results afterward.
Where AI fits in
AI Findings is a separate, optional, opt-in layer that runs after a scan completes: it reads the results and writes an executive summary, prioritized risks, per-finding remediation, attack-chain correlation and a MITRE ATT&CK kill chain. The compliance control matrix is a separate, deterministic thing: versioned rules over the scan evidence decide every verdict across seven frameworks, and no model decides one.
The scan engines never call an LLM. AI Findings (included) sends the scan's findings to the hosted AI provider to write the summary, the prioritized risks and the attack-chain analysis. Selecting compliance analysis also sends the rule engine's verdict matrix to the hosted AI provider for the plain-language narrative, and the narrative never changes a verdict. With both off, nothing is sent to an AI provider. The provider is contractually prohibited from training on your data.
How does OnScanner detect vulnerabilities?
Rather than one monolithic crawler, OnScanner runs purpose-built engines in parallel: security (OWASP Top 10 classes, exposed services, misconfigurations), privacy and trackers (40+ categories including pixels, fingerprinting, session recording, and consent/CMP compliance), technology fingerprinting, DNS/TLS and WAF posture, and email security (DMARC, DKIM, SPF). Each engine emits structured findings with the evidence it observed, so a result can be traced back to the response, header, or behavior that produced it.
Where does the vulnerability data come from?
When OnScanner fingerprints a product and version, it matches against CVE data sourced from the National Vulnerability Database (NVD) and vendor/distribution advisories, not a hand-maintained list. Findings are prioritized with EPSS (exploit-prediction scoring) and flagged when they appear on CISA's Known Exploited Vulnerabilities (KEV) catalog. We also evaluate patch status and end-of-life (EOL) state, so you can tell a genuinely exploitable, unpatched issue from a CVE that does not apply to your build.
What does "zero-day heuristics" mean?
Some checks are behavioral rather than signature-based: they reason about what a response means (timing, reflected input, error semantics) instead of only matching a known fingerprint. This can surface anomalies before a CVE exists. To be clear about the claim, these are heuristics that flag suspicious behavior for review. They are not a guarantee of discovering novel vulnerabilities, and we do not claim CVE credits we have not earned.
How do active exploitation probes stay safe?
Where OnScanner actively verifies whether a known CVE is exploitable, the probes are non-destructive and verify in-band: they read the response body, status, or timing of the target itself. They do not modify target state and do not rely on out-of-band DNS or callback listeners. Active probes only run against targets you own or are explicitly authorized to test, and this is enforced at the account level.
Is scan data cached, and does it touch an LLM?
Every scan runs in real time against the target, and nothing is served from a cache. The scan engines never call an LLM. AI Findings (included) sends the scan's findings to the hosted AI provider to write the summary, the prioritized risks and the attack-chain analysis. Selecting compliance analysis also sends the rule engine's verdict matrix to the hosted AI provider for the plain-language narrative, and the narrative never changes a verdict. With both off, nothing is sent to an AI provider. The provider is contractually prohibited from training on your data. The compliance control matrix itself is computed by rules inside OnScanner.
See the evidence on your own site
Most scans finish in minutes. Every finding shows what was observed, where, and what was expected.