FAQ
How often can it check?
You set the interval when you configure monitoring on a project: from once a day to once every 90 days. The default is once every 7 days.
What is a regression?
A regression is when a fixed finding becomes exploitable again. It can happen when a code change reverts a fix, a dependency update reintroduces a patched vulnerability, or an infrastructure change exposes a mitigated attack vector.
Does monitoring cost credits?
Yes. Each monitoring run is charged as one run, however many findings it re-tests. A Pro plan includes a monthly number of monitor runs; after that, each run costs $2 in credits. See Credits and billing.
How do I get alerted?
AISafe raises a notification when it detects a regression. You can connect Slack to receive the notification there, or subscribe an outbound webhook to the monitoring.regression event. The dashboard shows the regression on the finding.
How does monitoring compare to a scheduled scan?
Monitoring re-tests the proofs-of-concept of known findings. A scheduled scan runs a full assessment that looks for new vulnerabilities. You can use both on the same project.
What happens when a finding regresses?
AISafe raises a regression event and changes the same finding to not fixed. Its finding code does not change. You then investigate the cause — recent code changes, dependency updates, or infrastructure changes — and fix the regression.
Does monitoring re-test every finding?
It re-tests every finding that qualifies, up to 50 per project. AISafe chooses them for you: confirmed black-box and white-box findings that carry a proof-of-concept or reproduction steps and are open, not fixed or fixed. When more than 50 qualify, the ones left out have the lowest severity and were discovered most recently. See Which findings are monitored.
Can monitoring find brand-new vulnerabilities?
No. Monitoring re-tests findings you already have. To find new vulnerabilities, run a new Black-Box Pentest or set up scheduled scans.