# Batch scan
Source: https://docs.privacycommand.privacykey.org/batch-scan

Triage a folder — or every app you have installed — in one pass.

Auditing one app at a time is fine when you have a suspect. Batch scan is for
when you don't: point privacycommand at a folder, or at all of
`/Applications`, and get a sortable, filterable table of everything at once.

Each row carries the app's risk tier, its warning and error counts, and the
headline signals behind them. The same analyzer runs on every bundle — this is
the full static pass, not a cheaper approximation.

Click any row to open that app in the main window for the complete report.

## What it's good for

**Fleet triage.** New machine, inherited laptop, or an IT estate you've just
taken responsibility for — this is the fastest way to find the handful of apps
worth a closer look.

**Finding the outliers.** Sorting by **Trackers** or risk surfaces the apps that
don't resemble their neighbours, which is usually more informative than any
absolute threshold. Note that the Trackers column counts only tracker-class SDK
hits, not every fingerprinted SDK — the full SDK count is in the CSV export and
in each app's own report.

**Periodic review.** Re-running a scan after a few months of updates shows which
apps have drifted. Pair it with [Compare runs](https://docs.privacycommand.privacykey.org/compare-runs) to see exactly
what changed in any one of them.

## Working through the results

Resist reading top to bottom. A more useful order:

**Step 1: Sort by risk tier, then scan the top**

The tier is a heuristic, not a verdict — but it's a reasonable reading
order.

**Step 2: Filter to what you don't recognise**

Bundled helpers and vendor utilities you've never opened are frequently the
most interesting rows in the table.

**Step 3: Compare like with like**

Two apps in the same category with very different tracker counts is a
question worth asking.

**Step 4: Open the interesting ones properly**

The table is triage. The judgement happens in the full report.

> **Note**
>
> A full `/Applications` scan takes a while — every bundle gets the real static
> pass, including the binary work. Start it and go and do something else.

## Getting the results out

The batch window has its own **Export** menu, separate from the single-app
[report exports](https://docs.privacycommand.privacykey.org/reports):

| Format | Contents |
|---|---|
| **CSV** | One row per app, twenty-two columns — identity, risk tier and score, signing, sandbox, hardened runtime, App Store origin, architecture, minimum macOS, update mechanism, download source, tracker and SDK counts, secrets, anti-analysis, launch items, hard-coded domains, concern flags, path, and any analysis error |
| **JSON** | The same rows as structured objects, wrapped with the scan's scope and a generated-at timestamp |

Both export the rows **currently shown** — filters and sort order are applied
first. Narrow the table to what you care about, then export.

This is the only way to get fleet-level results out of the GUI; the single-app
JSON, HTML and PDF exports cover one bundle at a time.

## From the command line

The same triage is available headless through
[`auditctl preview --all-apps`](https://docs.privacycommand.privacykey.org/auditctl), which is the better route for CI or
a scheduled job.