How to Run Your First VAPT Scan with GuardianX

This tutorial walks you through running your first end-to-end VAPT (Vulnerability Assessment and Penetration Test) scan with GuardianX — from connecting a target to exporting an auditor-ready PDF report. Total time: under 5 minutes for a small application.

Step 1: Create an Account and Log In

Sign up at guardianx.cloud. You'll get an email to verify your account. After verification, log in and land on the Command Center dashboard.

Step 2: Add a Client (Optional)

If you're an MSSP or consultant, create a Client to scope your scans. From the sidebar, click Clients → New Client, enter a name (e.g., "Acme Corp"), and save. Solo users can skip this.

Step 3: Connect a Codebase (SAST)

For static analysis, you connect your source code. Click Codebases → Add Codebase. Three options:

• Git URL — paste your repo URL and provide a PAT if private
• Upload ZIP — drag and drop a .zip of your source
• Live fetch — GuardianX clones the repo server-side

Once uploaded, GuardianX indexes the codebase (typically 10–60 seconds for repos under 100k LOC).

Step 4: Or, Add a Live Target (DAST)

For dynamic testing, click Engagements → New Target and enter a URL (e.g., https://staging.acme.com). For authenticated scans, you can also provide login credentials and GuardianX will crawl past the auth wall.

Important: Only scan targets you own or have written permission to test. Unauthorized scanning is illegal.

Step 5: Launch the Scan

From the codebase or target page, click Run VAPT Scan. GuardianX launches the pipeline:

1. Recon — nmap port scan, ffuf directory brute-force, tech fingerprinting 2. Crawl — Playwright browser crawls every reachable page 3. SAST — static analysis for 27 vulnerability classes (SQLi, XSS, SSRF, etc.) 4. DAST — RedAgent engine sends safe, non-destructive payloads 5. AI Triage — LLM correlates SAST + DAST findings, removes false positives 6. Patch Generation — for each finding, an AI patch is generated and sandbox-tested 7. Attestation — findings + patches are SHA-256 hashed and recorded on a ledger

Step 6: Watch the Live Pipeline

The Command Center shows a real-time pipeline view (via Socket.IO). You'll see:

• Live exploit terminal scrolling attack attempts
• Network topology of discovered hosts
• Attack heatmap by severity
• Findings table populating in real time

Step 7: Review Findings

Click any finding in the table to open the Finding Dialog:

• Severity (Critical / High / Medium / Low / Info) — CVSS v3.1 score
• Location — file:line for SAST, URL:parameter for DAST
• Evidence — proof-of-concept payload + response
• Suggested patch — AI-generated code diff
• Sandbox result — pass/fail of the patched version

Approve or reject each patch. Approved patches get a "Generate PR" button that opens a pull request on your repo.

Step 8: Export the Report

Click Export PDF in the top right. GuardianX generates an audit-ready report containing:

• Executive summary (AI-written, business-language)
• Technical findings table with CVSS scores
• Risk heat map
• Remediation timeline
• Attestation ledger entries (SHA-256 hashes)

The PDF is branded with your logo (uploadable in Settings) and ready to share with auditors, customers, or regulators.

Step 9: Set Up Continuous Scanning

One-off scans are good for compliance deadlines, but security is continuous. From a codebase page, toggle on Auto-scan on every commit — GuardianX will scan each PR and post findings as inline code comments.

For DAST, schedule recurring scans (daily, weekly) from the target page.

Step 10: Configure Alerts

In Settings → Integrations, connect Slack or Microsoft Teams. GuardianX will push Critical/High findings directly to your SOC channel. You can also enable daily email digests summarizing your security posture.

Tips for First-Timers

• Start with a non-production target to learn the tool
• Use the "Quick scan" preset for first runs (skips slow fuzzing)
• Review every Critical finding — they're rare but real
• Use the Guardian AI chatbot to ask "what should I prioritize?"

That's it — you've just run your first VAPT scan. Welcome to autonomous security.