​
Shallow Audits

A shallow audit is the fastest engagement mode. It covers OWASP Top 10 vulnerabilities with proof-of-concept exploitation only — no post-exploitation, no persistence, no exfiltration testing.
PropertyValue
Default duration30 minutes
Methodology scopeOWASP Top 10 + PoC
Post-exploitationDisabled
Best forCI/CD gates, pre-launch checks, smoke testing

​
What it covers

Shallow mode runs phases 1–6 of the attack methodology:
  1. Passive reconnaissance
  2. Subdomain enumeration
  3. Port and service scanning
  4. Web fingerprinting
  5. Vulnerability scanning
  6. Proof-of-concept exploitation (read-only)
It stops there. The agent will confirm a vulnerability exists and capture evidence, but it will not pivot, escalate privileges, attempt persistence, or exfiltrate data.

​
What it skips

To stay fast and CI-safe, shallow audits do not:
  • Run auth brute force or credential stuffing
  • Attempt SQL injection beyond detection-level payloads
  • Pivot from one finding to another
  • Exfiltrate or modify data
  • Test post-exploitation chains
If you need the full chain, use a Deep audit.

​
When to use

  • CI/CD integration — gate deploys on critical findings without blocking the pipeline for hours
  • Pre-launch checks — verify a new release before going to production
  • Continuous coverage — schedule daily or hourly runs against production
  • Regression testing — verify a previously remediated finding is still gone

​
Running a shallow audit

API 
curl -X POST https://api.withgiga.ai/api/workspaces/{workspaceId}/audits \
  -H "Authorization: Bearer $GIGA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "shallow",
    "targets": ["acme.example.com"]
  }'
Dashboard
  1. Open the workspace
  2. Click New Audit
  3. Select Shallow mode
  4. Confirm targets
  5. Click Launch

​
Expected output

A typical shallow audit produces 0–15 findings depending on the target’s surface area. Findings will be predominantly Medium and Low severity, with occasional High for clear misconfigurations. For exposed RCE or auth bypass — where deeper exploitation would be needed to confirm impact — the agent will note the discovery but mark severity conservatively. Run a Deep audit on the same target to fully validate.

​
Next steps

Deep Audits

Full 10-phase chain including post-exploitation.

Findings

Understand how findings are structured and prioritized.