Infrastructure license
This license allows users to conduct external scanning on IP addresses, domains and subdomains; as well as internal scanning on devices supporting Windows, Linux or MacOS.
Application license
The Application license covers infrastructure scanning; enhanced web-app scanning of unauthenticated pages; authenticated web-app scanning (pages behind the login); as well as API scanning (where users have uploaded a schema file).
When are licenses assigned?
Infrastructure license + external targets
Infrastructure licenses are assigned to external targets as soon as a scan (scheduled, on-demand, or ETS) is kicked off and a target is found to be active:
(If a target is found to be active, but you don't have enough licenses, it will be marked with an orange dot and we'll send you a message to let you know what to do next).
Infrastructure license + internal targets
Internal targets will only show up on your target's list if you have licenses available (they also need to be online when being linked).
Unlike external targets, unresponsive internal will consume a license whether they're unresponsive or not.
Licenses are ‘tentatively assigned’ to internal targets as soon as you link the agent and see it pop up on your target list. Below, you'll see there's no mention of the license release date, because one hasn't been officially 'consumed' yet.
Once you've kicked off a scan, the license is officially assigned and when you hover over the license icon, you'll see the license release date:
The screenshot shows an unresponsive internal target, consuming a license:
Application license
Application licenses are assigned when either authentication or an API schema has been added, the scan has been kicked off and the target is found to be active.
For targets with authentication provided, it'll look like this:
For targets that have authentication provided and an API schema uploaded, it'll look like this:
How long are licenses locked to a target?
Please note: deleting the target, cancelling the scan, removing/disabling the authentication or deleting the API schema will not release the license early.
Please note that Emerging Threat Scans will reset the consumption period for any target they run on. (As will any other vulnerability scan).
Infrastructure license
Licenses are deemed ‘in use’ for 30 days; re-scanning the target simply resets the consumption period. Once those 30 days have elapsed the license is released and available for use on another target.
Application license
Same as above: licenses are deemed ‘in use’ for 30 days; re-scanning the target simply resets the consumption period. Once those 30 days have elapsed – assuming you have deleted/disabled any authentication, removed any API schemas and no scans have run – the license is released and available for use on another target.
If you forget to remove the authentication or the API schema, once you have removed it – assuming the 30 days have elapsed – the license will be released within 24 hours.
How do I know when my licenses are due for release?
There are a number of areas where you can find this information.
Targets > Licenses tab:
Target's detail page:
How do I know when my targets were last scanned for vulnerabilities?
You can find this information by heading to Targets > Licenses > Last scan column:
Normally you'll noticed the date listed in the Last Scan column is 30 days prior to the Release date shown under the License type column.
The only time there might be more than 30 days between the two dates is if a licensed internal target is showing as unresponsive. In that case, the Last scan column will list the last date it was successfully scanned for vulnerabilities, whilst the License type column will list the last time the license consumption period was reset (which is every time a scan is kicked off on an internal target, regardless of whether the target is active or not).
(The greyed out line item shows an internal device that has been deleted/agent unlinked, but is still consuming a license. Since it's been deleted, the license will be released from this unresponsive machine on 20th July).
How do I know if I need more licenses?
You'll see a banner at the top of the screen (as shown above). To find the exact number of licenses you need, have a look for 'Active' under 'Unlicensed'.
How do I increase/decrease my license count?
We’ve written an article on exactly this – just click here.
Can I re-assign a license?
No, unfortunately not. Once a license has been assigned to a target, it will remain 'locked' to it for 30 days.
Can I transfer a license from the IP address to the domain?
No, unfortunately not. The portal has no way of knowing that the two are affiliated and so it treats them as independent targets, each requiring a license to scan them.
What license do I need to scan web-apps?
What license do I need to scan APIs?
Questions about Infrastructure licenses
I need to add my web server as a target – what should I do?
We have just the article for this, head here.
What about scanning the same target internally and externally?
To scan the same target from both perspectives, you would need two licences. The reason for this is because each scanning perspective provides your with different insights:
The external scan reveals what is directly accessible from the internet right now – this could be web-layer security problems; infrastructure weaknesses or security misconfigurations.
Whereas, the internal scan is useful for viewing the device from the perspective of an attacker who has bypassed perimeter defences (perhaps in the form of an email), and is able to exploit internal configuration weaknesses; missing patches and encryption weaknesses.
Questions about Application licenses
How do I add authentication to a target?
You can only add authentications to a target if you have an Application license available; instructions on how to add them can be found here.
Can I change from an Infrastructure license to an Application license?
If an Infrastructure license has been assigned to the target, but you want to run an authenticated scan, then you’ll need to make sure you have an Application license available. Once you have added the authentication and kicked off a scan, the Application license is assigned and the infrastructure license is released (so you can use it to scan other targets from an unauthenticated perspective).
What happens if I have purchase an Application licence and run a scan before adding credentials?
The license will be assigned, but will only scan the infrastructure. As soon as you add the authentications, you can run another scan to cover the authenticated pages too.
What happens if I delete my authentication(s)?
👉 If you've scanned the target
The Application license will remain assigned to the target for 30 days and will reset with every subsequent scan, even if you have removed the credentials. Only once the 30 day consumption period has elapsed will the Application license be released and available for use on another target.
If an Application license is currently assigned to a target without credentials and you wish to continue with unauthenticated scanning only, please feel free to reach out via the chatbot and we can discuss options).
👉 If you haven't scanned the target
The Application license won't have been assigned and so it's available for immediate use on another target.
What do the icons mean?
This target has an application licenses assigned, and one set of authentication provided:
This target has an application licenses assigned, and two sets of authentication provided:
This target has an application license assigned, one set of authentication provided and API schema upload:
This target has an application license assigned, but no authentication of API uploaded:
