Troubleshoot Scan and Discovery Coverage Issues

Use this guide when the Optimizer reports a Coverage Drop for Discoveries or Coverage Issues for Scans.

Coverage problems usually mean that Bright discovered or tested fewer entry points than expected. This can happen because of changes to the application, authentication, target availability, connectivity, or execution configuration.

Discovery coverage dropped

A coverage drop means a Discovery found fewer entry points than expected compared with previous executions.

1. Check for recent application changes

Review changes made since the previous successful Discovery.

Check whether:

• Routes or endpoints were removed or changed.
• Navigation changed.
• The application's starting URL changed.
• Protected areas of the application changed.

If the application changed intentionally, the lower number of discovered entry points may be expected.

2. Check authentication

If the Discovery must authenticate to reach protected areas, confirm that authentication still works.

Check whether:

• Credentials changed.
• The login page or authentication flow changed.
• The configured Authentication Object is still valid.
• The Authentication Object belongs to the correct project.
• The authenticated session can still access the expected application areas.

Authentication problems can prevent Bright from reaching protected routes and reduce Discovery coverage.

3. Check the target and network

Confirm that the application was reachable during the Discovery.

Check:

• Target availability.
• DNS resolution.
• Firewall or WAF rules.
• VPN or private network access.
• Repeater connectivity, if a Repeater is used.

Temporary connectivity problems can prevent Bright from discovering parts of the application.

4. Check Discovery scope and starting points

Review the Discovery configuration.

Confirm that:

• The target is correct.
• The configured starting or seed URLs still lead to the expected application areas.
• The crawl scope has not been restricted.
• The uploaded file, if used, contains the expected targets.

If Bright reports that no entry points were found, review the target, crawl scope, authentication, seed URLs, and uploaded file before running the Discovery again.

5. Run a new Discovery

After correcting the underlying issue, start a new Discovery and compare the discovered entry points with a previous successful execution.

If coverage remains unexpectedly low, contact Bright Support with the Discovery ID and details of any recent application or configuration changes.

---

Scan coverage issues

A Scan coverage issue means some expected entry points may not have been tested successfully.

Start by reviewing the entry points associated with the affected Scan.

Problematic entry points

Problematic entry points may prevent complete security testing.

What to check

1. Review the entry point details and connectivity status.
2. Confirm that the target is responding correctly.
3. Check authentication if the entry point is protected.
4. Check whether the application behavior or endpoint has changed.
5. Run a new Scan after resolving the issue.

Unauthorized entry points

An unauthorized target cannot be tested until it is authorized for your organization.

What to do

1. Review the affected target host.
2. Authorize and verify the host.
3. Start a new Scan.

Unreachable entry points

Bright cannot fully test an entry point that cannot be reached.

What to check

1. Confirm that the application is running.
2. Verify DNS resolution.
3. Check firewall and WAF rules.
4. If you use a Repeater, verify that it is connected and can reach the target.
5. Start a new Scan after connectivity is restored.

No entry points match the Scan

If a Scan uses dynamic entry points and the configured filter matches no entry points, Bright cannot test the expected scope.

What to do

1. Review the entry point status filter.
2. Broaden the filter if appropriate.
3. Run a Discovery if the project does not contain the expected entry points.
4. Start a new Scan.

---

Confirm that coverage improved

After making changes, run a new Discovery or Scan.

Compare the new execution with a previous successful execution and confirm that:

• The expected entry points are discovered.
• Previously unreachable or unauthorized entry points can be accessed.
• Protected areas are reached when authentication is required.
• The execution completes without related connectivity or configuration errors.

If coverage continues to drop without an expected application change, contact Bright Support and provide the Scan or Discovery ID and relevant configuration details.