> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets.md). # Targets How to configure the applications that Snyk Continuous Offensive Security tests Configure the applications you want Snyk Continuous Offensive Security to test. A target is the persistent record of one application—its URL, scope, and credentials. You create a target once and scan it as often as you like. Use the pages in this section to add a target and manage existing ones. ## What is a target? A target is the persistent record of one application you want to test. It holds everything the AI Pentesting engine needs to assess that application, so you configure it once and scan it as often as you like. ### What a target holds | Element | Purpose | | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | A display name so you can identify the target in lists and reports | | **Main URL** | The primary entry point of the application. Always in scope | | **Scope** | The additional hosts and paths agents may reach, plus any paths they must never touch. See [Define the target scope](/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets/define-the-target-scope.md) | | **Users and credentials** | One or more users, ideally with different roles, that agents authenticate as. See [Configure authentication](/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets/configure-authentication.md) | | **Extra instructions** | Custom headers, cookies, and free-text context about the application. See [Before you begin](/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets/before-you-begin.md) | | **Linked repository** | An optional source repository. When present, agents use source code context and remediation guidance becomes file and line specific | ### Targets and scans A target is a configuration. A scan is one execution of that configuration. ``` Target (configured once) ├── Scan 1 → findings, report ├── Scan 2 → findings, report └── Scan 3 → findings, report ``` This separation is what makes findings trackable over time. Because each scan runs against the same target definition, Snyk Continuous Offensive Security can tell you whether a finding is new, still open, or no longer reproducible. That is what drives the first found and last found dates on every finding, and the fix rate on your target risk overview view. Every scan a target has ever run stays available on the target, so you can revisit a historical result or regenerate its report without rescanning. ### APIs are tested through the target, not as their own target A target is an application, and the APIs behind it are tested as part of that application. This is why the scope matters as much as it does. Agents observe the API calls the application makes and test those endpoints directly, but only where the API hostname is in scope. An API on a separate hostname that you did not add to the scope is rejected at the proxy, so it is never tested, even though the front end that calls it was scanned thoroughly. Add every hostname your application depends on to the scope, and the API surface is covered. See [Define the target scope](/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets/define-the-target-scope.md). An endpoint backed by an LLM is detected automatically and triggers red teaming coverage for AI-native threats such as prompt injection and tool abuse. This does not require a separate target either. ### How many targets should you create? Create one target per application, per environment. Staging and production are different targets even when they run the same code, because their scope, credentials, and risk tolerance differ. Do not split one application across several targets just because it spans multiple hostnames. Use the scope to include the additional hosts instead, so agents can follow the flows that cross between them. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/agent-security/evo-by-snyk/continuous-offensive-security-cos/targets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.