> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/vulnerability-testing-coverage.md).

# Vulnerability Testing Coverage

Vulnerability families available to assessment runs.

The definitive coverage for a run is the category list shown in **Run Assessment -> Scan settings**. Availability can vary by deployment, target type, permissions, and installed assessment capabilities.

Selecting a category permits applicable tests; it does not guarantee that every technique runs against every target. Discovery data, reachable functionality, authentication, safeguards, and runtime limits determine which tests are relevant.

## External Assessment

External categories are grouped in the UI:

| Group                               | Categories                                                                                                   |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Access control & identity**       | Authentication, Authorization, IDOR, OAuth, SAML, JWT                                                        |
| **Injection**                       | SQL Injection, NoSQL Injection, Command Injection, SSTI, XML, Email Injection                                |
| **Client-side**                     | XSS, CSRF, Open Redirect, Prototype Pollution                                                                |
| **Server-side & request**           | SSRF, Request Smuggling, Mass Assignment, Serialization, Cache, Directory Traversal, File Upload, WebSockets |
| **Information & application logic** | Information Disclosure, Prompt Injection, Prompt Leakage, Business Logic                                     |

All available categories are selected by default for broad coverage. Disable categories that are outside the engagement authorization.

Authenticated coverage can test the same categories from each selected browser-session role. A category being selected does not replace the need to record the relevant user flow or provide a valid session.

## Internal Assessment

Internal categories depend on the exploit and check families enabled for the tenant. Common families cover:

* credentials, secrets, and anonymous access;
* configuration and policy weaknesses;
* privilege escalation and ACL abuse;
* Active Directory trusts, delegation, and Kerberos tickets;
* AD CS certificate authorities and templates;
* lateral movement and remote code execution;
* authentication bypass and information disclosure;
* cloud identity, credential, data, policy, workload, network, persistence, defense-evasion, and destructive-impact paths.

Some families can modify directory, host, credential, ticket, or cloud state. Review [Internal Assessment Destructive Actions](/enterprise/how-to-trigger-an-internal-scan/internal-assessment-destructive-actions.md) before enabling them.

## Code Assessment

Code Assessment checks are outcome-based rather than mapped one-to-one to external attack vectors:

* vulnerable source-code paths;
* open-source dependency risk;
* leaked secrets and credentials;
* business logic and authorization;
* AI inventory for AI-BOM output.

The selected repository target—branch, PR, tag, or commit—defines which code is reviewed.

## Interpreting a Clean Result

No findings does not prove that every category was exercised. Before judging coverage, confirm:

* Discovery completed sufficiently for the target;
* selected browser sessions and agents remained healthy;
* relevant pages, APIs, hosts, services, or repositories were reachable;
* the run was not truncated by a runtime, rate, or concurrency limit;
* Activity does not show failed or cancelled submodules;
* exclusions and trajectory rules did not remove the intended surface.