Web Security Scanner identifies security vulnerabilities in web applications on Google Cloud through automated OWASP testing.
What is Web Security Scanner?
Web Security Scanner is Google’s integrated tool for detecting security vulnerabilities and misconfigurations in web applications on App Engine, GKE, and Compute Engine. The scanner crawls publicly reachable applications like an attacker: it follows links, fills out forms, and tests for known vulnerabilities such as XSS, SQL injection, and insecure configurations.
The scanner is part of Security Command Center. Managed scans run automatically without manual configuration, but are tied to the Premium or Enterprise tier of Security Command Center; the Standard tier provides only limited findings. Discovered vulnerabilities appear as findings in the Security Command Center dashboard.
For specific requirements, you can configure custom scans. These allow scanning authenticated areas, specific URL paths, or applications outside automatic detection.
Core Features
- Managed scans: Automatic, recurring vulnerability scans for detected web applications on App Engine, GKE, and Compute Engine.
- Custom scans: Manually configured scans for specific URLs, paths, or authenticated areas.
- OWASP coverage: Detection of XSS, SQL injection, mixed content, outdated libraries, SSRF, and missing security headers.
- Security Command Center integration: Central visibility of findings alongside other security alerts.
- Authenticated scans: Support for login-protected application areas using stored credentials.
Common Use Cases
Continuous Security Testing
A SaaS provider enables managed scans for all production applications on the Premium tier of Security Command Center. The scanner runs regularly and automatically reports new vulnerabilities. The security team receives alerts for critical findings.
Pre-Release Security Checks
A development team integrates custom scans into the CI/CD pipeline. Before each production deployment, the staging environment is scanned. The build fails if critical vulnerabilities are found.
Compliance Documentation
A financial services company must demonstrate regular security testing. Web Security Scanner reports serve as evidence for audits and support compliance requirements.
Authenticated Application Scans
An e-commerce platform also scans the admin area. Custom scans with stored credentials test login-protected functions. This uncovers vulnerabilities that anonymous scans cannot find.
Third-Party Applications on GCP
A company runs a CMS application on Compute Engine. Web Security Scanner finds outdated components with known vulnerabilities. The IT team receives prioritized updates based on severity.
Benefits
- Automated testing: Managed scans uncover known vulnerabilities without manual effort.
- OWASP-oriented: Broad coverage of common web vulnerability classes.
- Central visibility: Findings appear alongside other security alerts in Security Command Center.
- Flexibly extensible: Custom scans allow targeted testing of specific or authenticated areas.
- Compliance support: Regular, documented scans simplify audit evidence.
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you in integrating Web Security Scanner into your DevSecOps processes: from tier selection through pipeline integration to findings management.
Contact us for a security consultation.
Available Tiers & Options
Managed Scans
- Automatic detection
- No configuration needed
- Part of Security Command Center
- Only GCP resources
- Requires Premium or Enterprise tier
Custom Scans
- Manual scan configuration
- Specific URLs
- Authenticated scans
- Requires manual setup
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Web Security Scanner?
Web Security Scanner is an automated tool for detecting security vulnerabilities in web applications on App Engine, GKE, and Compute Engine. It crawls your application like an attacker and tests for OWASP Top 10 vulnerabilities such as XSS and SQL injection.
What vulnerabilities does Web Security Scanner detect?
The scanner detects Cross-Site Scripting (XSS), SQL injection, mixed content, outdated libraries, server-side request forgery, and missing security headers, among others. It covers most OWASP Top 10 categories.
How does Web Security Scanner differ from Cloud Armor?
Web Security Scanner finds vulnerabilities in your application and is intended for development and testing. Cloud Armor protects against attacks at runtime through WAF rules. Both complement each other in a DevSecOps strategy.
How much does Web Security Scanner cost?
Web Security Scanner is part of Security Command Center. Some findings are already available in the Standard tier, while full managed scans and advanced detections such as SQL injection testing require the Premium or Enterprise tier. Current terms are available on the official pricing page.
Can I scan authenticated areas?
Yes, with custom scans you can configure credentials so the scanner also tests protected areas of your application. Credentials are stored securely.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
