Scan Depth Tiers Explained: Quick, Deep and Super-Deep
What actually changes between a Quick scan (63 scanners), a Deep scan (228 scanners) and a Super-Deep scan (all 232) — and when to use each.
Every 2MNY scan is powered by the same engine: a registry of 232 live scanner modules. What changes between scan types is how many of those modules run, and which heavy tools are unleashed. This article documents the tier system precisely, so you know exactly what you are getting with each scan depth.
The three scan depths
| Depth | Scanners that run | Typical use | Typical duration |
|---|---|---|---|
| Quick | 63 fast modules | Continuous monitoring, frequent re-checks | Minutes |
| Deep | 228 modules (all Quick modules + 165 deep-tier modules) | Full security assessment, scheduled periodic audits | 30–90 minutes |
| Super-Deep | All 232 modules (everything + 4 heavy-artillery tools) | Pre-launch audits, penetration-test-grade reviews, annual reviews | Several hours |
The counts are live counts from the scanner registry — not marketing numbers. The platform reads the registry directly and displays whatever is actually registered and enabled at scan time.
Quick scans — the always-on baseline
Quick scans run 63 modules that complete fast: HTTP security headers, cookie flags, TLS basics, robots.txt and sitemap hygiene, technology fingerprinting, mixed-content checks, and similar single-request checks. They are designed to be run frequently — daily or even multiple times per day — because they catch the most common regressions: a header disappearing after a deploy, an SSL certificate renewed with weaker settings, a new cookie without the Secure flag.
Use Quick scans when you want continuous assurance between bigger audits.
Deep scans — the full assessment
A Deep scan runs 228 modules: every Quick module plus 165 deep-tier modules. This is where the platform's breadth lives — CMS-specific auditing (WordPress, Drupal, Joomla, Magento), SQL injection and XSS detection engines, CORS deep testing from multiple origin vectors, exposed backup and sensitive-path hunting, JavaScript secret extraction, subdomain enumeration through certificate transparency, email security (SPF, DKIM, DMARC), port scanning with banner grabbing, and hundreds more.
Because a Deep scan includes every Quick module, there is never a coverage gap between the two depths — a Deep scan is a strict superset.
Use Deep scans for scheduled security assessments: weekly for high-risk sites, monthly for most others.
Super-Deep scans — the heavy artillery
Super-Deep adds the 4 modules that are too expensive to run on every scan because they take significant time and generate meaningful request load against your site:
- OWASP ZAP — full active web application scanning
- Wapiti — independent web scanner for black-box auditing
- Nuclei batch — the full known-vulnerability template corpus run against your target
- Additional exhaustive discovery passes
These tools emulate what a human penetration tester would run. Use Super-Deep scans before major launches, after significant architecture changes, or as an annual deep audit. Because they generate real attack traffic, the platform runs at most one Super-Deep scan at a time by policy.
How to choose
A practical cadence that works for most organizations:
- Quick scan daily — catch regressions fast.
- Deep scan monthly — full 228-module assessment, tracked scan-over-scan with the rescan diff (new vs resolved findings).
- Super-Deep scan quarterly or before launches — the complete 232-module arsenal including ZAP and the full Nuclei corpus.
Where the numbers come from
The scanner registry is re-read live from the engine for every published statistic. As modules are added or retired, the platform's public numbers update automatically — which is why you may see the counts grow over time. Every scan report also includes a Coverage Ledger chapter showing exactly which modules ran, which failed, and which never executed — so a clean report is never confused with a scan that did not complete.