Skip to main content
Strix provides three scan modes optimized for different use cases and time constraints. Each mode balances thoroughness against execution time to fit your workflow.

​
Overview

You specify the scan mode using the --scan-mode or -m flag: 
strix --target https://your-app.com --scan-mode <mode>
Available modes:
  • quick - Fast CI/CD checks (5-15 minutes)
  • standard - Routine testing (30-60 minutes)
  • deep - Thorough security reviews (2-4 hours)
The default scan mode is deep, which provides the most comprehensive security assessment.

​
Quick Mode

Best for: CI/CD pipelines, rapid feedback, pre-commit checks 
strix --target ./my-app --scan-mode quick

​
Characteristics

  • Duration: 5-15 minutes
  • Coverage: Critical and high-severity vulnerabilities
  • Depth: Surface-level analysis with automated validation
  • Agent behavior: Focused on common attack patterns
  • Reasoning effort: Medium (optimized for speed)

​
What Quick Mode Tests

  • Authentication bypass attempts
  • Basic privilege escalation checks
  • Common IDOR patterns
  • SQL injection (common payloads)
  • Command injection
  • Basic XSS detection
  • Exposed sensitive endpoints
  • Common security header issues
  • Default credentials
  • Dependency scanning
  • Known CVEs in libraries
  • Outdated component detection

​
Example: Quick CI/CD Check

strix -n --target ./app --scan-mode quick
Terminal output: 
[STRIX]
Scan mode: quick
Target: ./app

[12:34:56] Starting security assessment...
[12:35:12] Found SQL injection in /api/users
[12:35:45] Validating IDOR vulnerability...
[12:36:20] CRITICAL: Authentication bypass confirmed

Scan completed in 6m 34s
Output: strix_runs/app-20260301-123456
Quick mode is optimized for speed and may miss complex vulnerabilities that require deeper analysis. Use it for rapid feedback, but run standard or deep scans before production deployments.

​
Standard Mode

Best for: Regular development testing, staged environment validation, weekly security checks 
strix --target https://staging.example.com --scan-mode standard

​
Characteristics

  • Duration: 30-60 minutes
  • Coverage: All common vulnerability classes
  • Depth: Moderate analysis with thorough validation
  • Agent behavior: Explores multiple attack vectors
  • Reasoning effort: High (balanced approach)

​
What Standard Mode Tests

Everything in Quick Mode, plus:
  • Race conditions
  • Workflow manipulation
  • Payment and transaction logic
  • State management issues
  • NoSQL injection
  • XML injection and XXE
  • Template injection
  • LDAP injection
  • JWT vulnerabilities
  • Session fixation
  • Cookie security
  • Token manipulation
  • DOM-based XSS
  • Prototype pollution
  • CSRF vulnerabilities
  • Clickjacking

​
Example: Staging Environment Test

strix --target https://staging.example.com --scan-mode standard
Terminal output: 
[STRIX]
Scan mode: standard
Target: https://staging.example.com

[14:22:10] Mapping attack surface...
[14:25:33] Testing authentication flows...
[14:31:18] Found race condition in checkout process
[14:42:55] Validating SSRF vulnerability...
[14:58:02] Confirmed JWT algorithm confusion

Scan completed in 47m 22s
Vulnerabilities found: 8 (3 critical, 5 high)
Output: strix_runs/staging-example-com-20260301-142210

​
Deep Mode

Best for: Pre-production security reviews, compliance requirements, comprehensive assessments 
strix --target https://your-app.com --scan-mode deep

​
Characteristics

  • Duration: 2-4 hours
  • Coverage: Comprehensive vulnerability detection
  • Depth: Exhaustive analysis with multi-stage validation
  • Agent behavior: Multi-agent collaboration, creative exploitation
  • Reasoning effort: High (maximum thoroughness)

​
What Deep Mode Tests

Everything in Standard Mode, plus:
  • Server-Side Request Forgery (SSRF)
  • Deserialization vulnerabilities
  • File inclusion (LFI/RFI)
  • Path traversal
  • Multi-step workflow vulnerabilities
  • Advanced race conditions
  • Complex state manipulation
  • Financial transaction security
  • Container escape attempts
  • Cloud misconfigurations
  • Network segmentation issues
  • Service exposure analysis
  • Multi-vulnerability chains
  • Privilege escalation paths
  • Cross-service attack vectors
  • Defense bypass techniques

​
Example: Comprehensive Security Review

strix --target ./production-app --scan-mode deep
Terminal output: 
[STRIX]
Scan mode: deep
Target: ./production-app

[09:15:22] Starting comprehensive security assessment...
[09:18:45] Attack surface mapping complete - 47 endpoints discovered
[09:32:11] Testing authentication mechanisms...
[09:51:33] Found potential deserialization vulnerability
[10:15:28] Validating exploit chain: SSRF → Internal API access
[10:42:17] Confirmed privilege escalation path
[11:19:55] Testing business logic in payment flow...
[12:03:44] Discovered race condition in withdrawal process
[12:28:31] Validating all findings with proof-of-concepts...

Scan completed in 3h 13m 09s
Vulnerabilities found: 14 (5 critical, 6 high, 3 medium)
Output: strix_runs/production-app-20260301-091522
Deep mode uses the highest reasoning effort and most thorough agent collaboration. This is the recommended mode for security reviews before production deployments.

​
Choosing the Right Mode

1

Identify your use case

Consider your time constraints and security requirements:
  • Need results in minutes? Use quick mode
  • Regular development testing? Use standard mode
  • Pre-production security review? Use deep mode
2

Consider your environment

Match the mode to your testing environment:
  • CI/CD pipeline: Quick mode
  • Staging environment: Standard mode
  • Production-like environment: Deep mode
3

Factor in coverage needs

Determine how comprehensive you need the assessment:
  • Critical vulnerabilities only: Quick mode
  • Common vulnerability classes: Standard mode
  • Exhaustive security testing: Deep mode

​
Scan Mode Comparison

FeatureQuickStandardDeep
Duration5-15 min30-60 min2-4 hours
CoverageCritical onlyCommon classesComprehensive
Agent depthSurface-levelModerateExhaustive
Best forCI/CDDevelopmentPre-production
ReasoningMediumHighHigh
Chain exploitsNoLimitedYes

​
CI/CD Integration Example

Use quick mode in your GitHub Actions workflow: 
name: Security Scan

on:
  pull_request:

jobs:
  strix-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      
      - name: Install Strix
        run: curl -sSL https://strix.ai/install | bash
      
      - name: Run Quick Security Scan
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: strix -n -t ./ --scan-mode quick

​
Performance Tuning

You can further optimize scan performance with environment variables: 
# For quick scans, use medium reasoning effort
export STRIX_REASONING_EFFORT="medium"
strix --target ./app --scan-mode quick

# For deep scans, use high reasoning effort (default)
export STRIX_REASONING_EFFORT="high"
strix --target ./app --scan-mode deep
Available reasoning effort levels:
  • none - Minimal reasoning (fastest)
  • minimal - Basic reasoning
  • low - Light reasoning
  • medium - Moderate reasoning (recommended for quick scans)
  • high - Thorough reasoning (default)
  • xhigh - Maximum reasoning (experimental)
Lower reasoning effort speeds up scans but may reduce vulnerability detection accuracy. Use with caution.

​
Next Steps

Custom Instructions

Guide Strix to focus on specific areas regardless of scan mode

Advanced Testing

Learn about authenticated testing and complex scenarios

Build docs developers (and LLMs) love

Get started for freeTalk to us