Key concepts in Strobes

Strobes is built around a set of connected objects: you bring your assets into an organization, scan them through connectors, and the results land as findings that you prioritize, fix, measure, and report on. If you are new to the platform, this article explains each of those objects, how they relate to each other, and where they live in the product.

Organization, members and roles

Everything in Strobes lives in one organization, your workspace. Members of the organization are the individual users invited into it, and each member is assigned a role that controls what they can see and do. Built-in roles include Owner, Manager, Member, and Read Only, and you can create custom roles with granular permissions. Roles also control which assets a member can access. See Inviting members and managing roles.

Assets and linked assets

An asset is a discrete thing you want to track or test, such as a web application, a mobile app, a network range or IP, a cloud service, a container image, or a code repository. Assets are the backbone of vulnerability management: findings are reported against them, and scanning is scoped to them. You can also link related assets, such as a web app plus its API and database, so they are treated as one service with a combined risk score. See Understanding and managing assets and What are linked assets?.

Findings, alerts and vulnerabilities

A finding is anything Strobes surfaces about your security posture, and it is the umbrella term for the two categories below.

• Alerts are findings from exposure-monitoring sources: attack surface management (ASM) and cloud security posture management (CSPM). They describe things happening around your organization, such as a leaked credential or a new shadow-IT asset.
• Vulnerabilities are findings from scanning a specific asset for a specific weakness, such as a missing patch, a SCA or SAST result, or a pentest finding.

When you work in Finding Overview, you see the combined view of both. See Alerts vs. Vulnerabilities vs. Findings.

Severity and priority score

Severity is the inherent seriousness of a vulnerability, commonly taken from sources such as CVSS. The priority score goes further: it is a calculated score that helps your teams decide what to fix first. Strobes computes it from four metrics with configurable weightage: exploit availability, SLA, asset exposure, and asset sensitivity. You can adjust the weightage on the Prioritization Rules page. See Prioritization rules.

SLA

An SLA (service level agreement) policy defines the accepted timeframe for resolving vulnerabilities, usually based on severity, for example 2, 15, and 30 days for critical, high, and medium vulnerabilities. Once a policy is set, Strobes tracks each vulnerability against its due date and flags it as compliant or violated, and can alert your team on violations. See Configuring SLA.

Connectors and the credential manager

Connectors extend Strobes to third-party security and IT tools. They let you run or schedule scans, import assets and findings, sync with bug trackers, and send notifications to tools like Slack or MS Teams. Connectors are managed under Connectors > Overview. Many connectors need authentication, such as an API key or a username and password; the Credential Manager under Settings lets you store and reuse those credentials securely across configurations. See Everything about connectors and Using the credential manager.

Tasks

A task is an action that Strobes performs, either on-demand or on a schedule. There are three types:

• Scan tasks, created when a connector initiates an ad-hoc, scheduled, or remote scan.
• Import tasks, created when you import assets or vulnerabilities.
• Export tasks, created when you export reports or data.

Tasks have a status (Running, Aborted, Failed, or Finished) and can be tracked from the Tasks page, with logs available for troubleshooting. See What is a task?.

Engagements and assessments

An engagement is a structured security assessment with a defined scope: a penetration test run by an external vendor, an internal vulnerability assessment run by your own team, or an AI-driven automated assessment. Each engagement groups the findings it produces and tracks them through statuses, with delivery dates and assigned team members. The scope defines exactly which assets and services will be tested and how. See What is an engagement in Strobes? and Defining engagement scope.

AI pentest workspaces and templates

AI pentest workspaces (found under AI > Workspaces) are where Strobes AI agents run automated penetration tests: reconnaissance, vulnerability testing, and reporting. When you create a workspace, you start either from a template, a pre-configured assessment with a defined methodology (for example Web App Pentest or Network External), or from a Blank Workspace, a free-form chat-driven run you describe in plain English. See Initiating an AI pentest and Choosing a template or a blank workspace.

Automations

Automations let Strobes act automatically on events across your data, for example sending a Slack notification for critical vulnerabilities, creating a Jira ticket, or alerting on an SLA deadline. You can build an automation from scratch or pick from a library of ready-to-use templates, then define the trigger events, filters, and actions. Automations are managed under Automations in the left sidebar. See Creating a new automation and Using automation templates.

Dashboards and reports

Dashboards are visual workspaces that bring your security data together as charts, KPIs, and tables, from default templates such as the risk summary or patch and SLA summary to fully custom dashboards you build yourself. Reports are generated documents that summarize findings, risk, or engagement results, and they all land in one place on the Reports page where you can download, manage versions, and regenerate them. See Introduction to dashboards and What's in the Reports Page?.

How it all fits together

In short: assets are brought into your organization and linked where they form a single service; connectors scan or import data against those assets; the results become findings (alerts or vulnerabilities) that carry a severity and a priority score; SLA policies and automations keep the fixes on track; engagements and AI pentest workspaces organize structured testing; and dashboards and reports turn everything into a view you can monitor and share.