What types of licenses do we have?

Infrastructure licenses

This license allows users to conduct external scanning on IP addresses, domains and subdomains; as well as internal scanning on devices supporting Windows, Linux or MacOS.

Authentication licenses

The Authentication License can be used to conduct infrastructure scanning and authenticated web-app scanning (where authentication has been provided); allowing us to scan your perimeter and those pages behind the login.

The license supports many authentications on one target, which is very useful if you want to scan:

  • An application with different user types

  • An application with different permission levels

  • An IP address or domain hosting multiple applications

Authenticated web-app scanning is an add-on feature, available across all plans. If you have more questions about authentication licenses, just head to the bottom of this page. 👇

When are licenses assigned?

Infrastructure and Authentication licenses are assigned to external targets as soon as a scan (scheduled, on-demand, or ETS) is kicked off and a target is found to be active. (If a target is found to be active, but you don't have enough licenses, it will be marked with an orange dot and we'll send you a message to let you know what to do next).

Licenses are ‘tentatively assigned’ to internal targets as soon as you link the agent and see it pop up on your target list. (For that reason, you can only add as many internal targets as you have licenses available). However the license is formally assigned as soon as the scan is started, regardless of whether the target is active or not.

How long are licenses locked to a target?

License are deemed ‘in use’ for 30 days, only once those 30 days have elapsed is the license released and available for use on another target.

Please note, deleting the target, cancelling the scan or removing the authentication does not release the license. You can re-scan the same target(s) as many times as you like without using any additional licenses – it just resets the 30 days.

How do I know if my target is consuming a license / has authentication provided?

The first icon shows that the target is consuming a license, the second indicates that authentication has been added.

How do I know when my licenses are due for release?

Head to the targets page and click 'Licenses'. The ‘License release’ column is what you’re looking for.

Can I increase/decrease my license count?

We’ve written an article on exactly this topic, which you can find here.

How many licenses do I need to scan the same target internally and externally?

You would need two. The reason for this is because they scan from different perspectives: 

  • The external scan reveals what is directly accessible from the internet right now – this could be web-layer security problems; infrastructure weaknesses or security misconfigurations.

  • Whereas, the internal scan is useful for viewing the device from the perspective of an attacker who has bypassed perimeter defences (perhaps in the form of an email), and is able to exploit internal configuration weaknesses; missing patches and encryption weaknesses.

I need to add my web server as a target – should I use the hostname or IP address and how many licenses is that?

We have just the article for this, head here.


Questions about Authentication licenses

How do I add authentication to a target?

You can only add authentications to a target if you have an Authentication license available; instructions on how to add them can be found here.

Can I change from an Infrastructure license to an Authentication license?

If an Infrastructure license has been assigned to the target, but you want to run an authenticated scan, then you’ll need to make sure you have an Authentication license available. Once you have added the authentication and kicked off a scan, the authentication license is assigned and the infrastructure license is released (so you can use it to scan other targets from an unauthenticated perspective).

What happens if I have purchase an authentication licence and run a scan before adding credentials?

The license will be assigned, but will only scan the infrastructure. As soon as you add the authentications, you can run another scan to cover the authenticated pages too.

What happens if I delete my authentication(s)?
👉 If you've scanned the target

The Authentication license will remain assigned to the target for 30 days and will reset with every subsequent scan, even if you have removed the credentials. Only once the 30 day consumption period has elapsed will the authentication license be released and available for use on another target.

If an authentication license is currently assigned to a target without credentials and you wish to continue with unauthenticated scanning only, please feel free to reach out via the chatbot and we can discuss options).

👉 If you haven't scanned the target

The authentication license won't have been assigned and so it's available for immediate use on another target.

Did this answer your question?