Professional

Reviewing findings

Last updated: July 23, 2026
Read time: 2 Minutes

Burp AT records vulnerabilities it finds as issues in Burp. Issues raised by Burp AT work in the same way as those raised by Burp Scanner or during your manual testing.

More information

For more information on what Burp issues contain and how they work, see Issues.

Where to review issues

You can review issues raised by Burp AT wherever Burp shows issues:

In the conversation - Burp AT reports each finding as it works, so you can see it in context straight away.
In the Dashboard - issues Burp AT raises when scanning appear on the Issues tab of the scan task.
On the site map - Each issue is linked to the corresponding site map entry, so it shows against the relevant node in Target > Site map.

Verifying issues

As with "regular" Burp issues, all issues reported by Burp AT include the requests and responses used to find it. This enables you to easily reproduce them, confirm they're exploitable, and report them with confidence.

Burp AT does not have prior knowledge of how your application is meant to work, so it may report intended behavior as a vulnerability. For example, it may flag a deliberate search feature as an injection point.

Note

Burp AT sets the severity and confidence of each issue itself. We recommend you confirm these before relying on them. It can also update its own issues as it works, for example by lowering a severity or deleting one it no longer believes to be true.

You can review, edit, and delete issues raised by Burp AT as you would normally. For more information on managing issues manually, see Issues.