> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-network-assessment.md).

# Network Assessment

Assess internal networks, Active Directory, and cloud accounts from an agent inside your environment.

Network Assessment tests the systems an attacker could reach from inside your environment: hosts, services, Active Directory, and cloud accounts. All work runs from a Pentest Copilot **agent** that you install on a host inside the approved network.

Like Web, a Network run has two phases:

| Phase                                                                                         | What it does                                                                                | Changes target state?                      |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------ |
| [**Discovery**](/enterprise/how-to-trigger-a-network-assessment/network-discovery.md)         | Finds live hosts, services, directory objects, and cloud inventory.                         | No. Enumeration only.                      |
| [**Assessment**](/enterprise/how-to-trigger-a-network-assessment/network-assessment-phase.md) | Tests the discovered inventory with the exploit families you allow and builds attack paths. | Yes, depending on the families you enable. |

## Before You Start

{% stepper %}
{% step %}

### Install an agent

Generate a launcher in **Settings -> Agent** and run it on a host that can route to the approved subnets. See [Download Agent](/enterprise/download-agent.md).
{% endstep %}

{% step %}

### Confirm what the agent can see

Open **Attack Surface -> Agents** and check that the agent is connected and reports the subnets and network interfaces you expect. Only subnets the agent reports can be selected.
{% endstep %}

{% step %}

### Agree what may be changed

Decide which exploit families, credential capture, and relay behavior are allowed, and who owns cleanup. Review [Network Assessment Destructive Actions](/enterprise/how-to-trigger-a-network-assessment/network-assessment-destructive-actions.md) with the system owners.
{% endstep %}
{% endstepper %}

## Choose an Intent

Open **Modules -> Network Assessment -> Run Assessment** and pick one:

<figure><img src="https://232193438-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwolEZzMm5QD9NoFKutSj%2Fuploads%2Fgit-blob-ca1e42626e8010826c04d938cab024fa4bc88a16%2Fnetwork-intent.webp?alt=media" alt="Network intent step with Discovery, Assessment, and Discovery plus Assessment"><figcaption><p>Discovery + Assessment is selected by default.</p></figcaption></figure>

| Intent                     | Use it when                                                                                    |
| -------------------------- | ---------------------------------------------------------------------------------------------- |
| **Discovery**              | It is the first run on a network, or exploitation is not approved yet.                         |
| **Assessment**             | Discovery is current and you want to exclude specific entities or re-verify existing findings. |
| **Discovery + Assessment** | You want a fresh inventory tested in one run, with no per-entity exclusions.                   |

Start with **Discovery** on one small subnet, review what it found, then run **Assessment** with a narrow set of exploit families.

## Settings Shared by Both Phases

* **Agent.** Every run executes from one connected agent. For Assessment, each discovered root can use a different agent.
* **Automation and Review.** Run now or schedule, then confirm the final summary. See [Run Assessment Wizard](/enterprise/run-assessment-wizard.md).

Network runs have no rate-limit or egress settings: traffic originates from the agent inside your network.

## Cloud Accounts

Cloud assessment also uses this module. An agent on an AWS, Azure, or Google Cloud VM discovers the cloud account through the VM's attached identity, and the result appears as a cloud scope you can assess. See [Cloud Assessment](/enterprise/how-to-trigger-a-cloud-assessment.md).

## Monitor and Review

* **Activity -> Activity** shows `NETWORK_DISCOVERY` and `NETWORK_ASSESSMENT` rows, with cancel controls.
* **Activity -> Attack Logs** contains detailed agent output.
* **Network Assessment -> Statistics** summarizes the inventory and findings.
* **Network Assessment -> Attack Paths** lists validated findings for triage and retest.
* **Reports** generates deliverables.

## Common Blocks

| Problem                                                               | Check                                                                                    |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| No agent can be selected                                              | A network agent must be connected and assigned to the workspace.                         |
| Expected subnet is missing                                            | The selected agent must report and route to it.                                          |
| Assessment lists no roots                                             | Run Discovery first.                                                                     |
| Intercept is on but launch is blocked                                 | Select at least one interface on the execution agent.                                    |
| AWS prefix error on a non-AWS run                                     | Clear **AWS resource name prefixes**. They are optional and only apply to AWS.           |
| "Network assessment is not available in this shared-trial workspace." | Shared trials support Web assessment only. Contact Bugbase for an enterprise deployment. |