Professional
Reviewing findings
-
Last updated: August 3, 2026
-
Read time: 2 Minutes
Burp AT records vulnerabilities it finds as issues in Burp. Issues raised by Burp AT work in the same way as those raised by Burp Scanner or during your manual testing.
More information
For more information on what Burp issues contain and how they work, see Issues.
Where to review issues
You can review issues raised by Burp AT wherever Burp shows issues:
In the conversation - Burp AT reports each finding as it works, so you can see it in context straight away.
In the Dashboard - issues Burp AT raises when scanning appear on the Issues tab of the scan task.
On the site map - Each issue is linked to the corresponding site map entry, so it shows against the relevant node in Target > Site map.
Verifying issues
As with "regular" Burp issues, all issues reported as a result of a Burp AT task include the requests and responses used to find them. This enables you to easily reproduce them, confirm they're exploitable, and report them with confidence.
You can send requests from Burp AT to other Burp tools to work on manually. For more information on how to do this, see Sending a request to another Burp tool.
Burp AT does not have prior knowledge of how your application is meant to work, so it may report intended behavior as a vulnerability. For example, it may flag a deliberate search feature as an injection point.
Note
Burp AT sets the severity and confidence of each issue itself. We recommend you confirm these before relying on them. It can also update its own issues as it works, for example by lowering a severity or deleting one it no longer believes to be true.
You can review, edit, and delete issues raised by Burp AT as you would normally. For more information on managing issues manually, see Issues.