Asset Map

What is the asset map?

The asset map is the foundation of every pentest. Before any testing happens, ModernPentest builds a live graph of your application — every page, API endpoint, backend service, auth provider, third-party integration, and data store it can reach, plus the relationships between them.

Everything that follows reasons over this graph. Instead of running a fixed checklist against one URL at a time, our AI auditor sees the whole map at once — how your sign-in flow connects to your dashboard, which API an authenticated page calls, where that API stores data — and decides what is actually worth attacking.

Why a graph?

Most real-world vulnerabilities live in the connections between components, not in any single request. A graph lets us:

• Reason with context — An endpoint that returns user data is only interesting once we know which page calls it, what authentication it expects, and which database it reads. The graph makes those relationships explicit.
• Chain findings — A confirmed SSRF on one node becomes the starting point for reaching an internal service two hops away. The map is what makes that pivot visible.
• Measure coverage honestly — Because every asset is a node, we can show exactly what was tested, what is in progress, and what we couldn't reach — instead of an opaque "scan complete."
• Track change over time — Re-running recon diffs the new graph against the old one, so you see what appeared, what went away, and what's newly exposed.

Nodes: your assets

Each node is a discovered asset. The layout reads left to right by discovery depth — the public internet on the left, flowing inward through pages and auth to APIs, backends, and data stores.

Every node also carries the signal the auditor needs: the authentication it expects (public, authenticated, admin, or signed), the technology recon fingerprinted, and a running vulnerability count by severity.

Edges: relationships

Edges are the traversals recon discovered between assets. The relationship type is what lets the auditor reason about data flow and trust boundaries.

Test status & coverage

Every node shows where it stands in the current pentest:

Tested nodes also carry a coverage percentage — the share of in-scope probes that actually ran against that asset — so "tested" never hides a half-finished job.

Discovery blockers

Sometimes recon reaches a node but can't go further — a login wall, a CAPTCHA, a rate limit. Rather than silently dropping that branch, the map flags it with a discovery blocker so you know precisely where coverage stopped and why.

Each blocker is tagged with who can clear it. Most are actionable by you (supply credentials, allow-list our scanner, relax a challenge) and come with a resolution hint. A few are flagged as platform issues that our team is already alerted to. See WAF Bypass Configuration for the most common fix.

The live lens

While a pentest runs, switch the map to its live lens (the Live scan toggle in the demo above) to watch testing happen in real time:

• Agent avatars sit on the nodes each agent is working. They show three states — scheduled (queued), testing (active, pulsing), and completed.
• Newly discovered assets flash as recon surfaces them, so the graph visibly grows.
• Findings pulse on their node the moment a prover confirms one, tinted by severity.
• An activity rail streams the distilled events — discoveries, findings, status changes — without drowning you in raw tool calls.

Attack paths

For each confirmed vulnerability, ModernPentest extracts an attack path — the chain through your asset map an attacker would walk, from entry point to impact, told as a story. A synthetic attacker node anchors the left side; each step is a real asset on your map, annotated with the technique used. It turns "BOLA on /api/applications" into a concrete narrative your team can follow and reproduce.

Asset lifecycle

Because the map persists across scans, each node carries a lifecycle status:

This is what powers change alerting — a new admin endpoint or a freshly exposed service stands out instead of getting lost in the noise.

How the map is built

Three agent roles turn a URL into a fully tested asset map:

Next steps

• Meet the AI agents that build and attack the map
• Run your first pentest and watch the live lens
• Configure WAF bypass so recon can reach everything

Last updated: June 11, 2026