A web application and website can be scanned in five steps: setting up the scanner, scanning the application for vulnerabilities, having a security analyst prioritise vulnerabilities based on business risk, delivering scan results and assessments, and remediating and testing vulnerabilities.