diff --git a/src/index.js b/src/index.js
index 9bb8b4f1..cc4b5c2e 100644
--- a/src/index.js
+++ b/src/index.js
@@ -42,7 +42,10 @@ async function scan(params, cliArgs = [], localScanner = false) {
 }
 
 function scanWithCallback(params, cliArgs, localScanner, callback) {
-  scan(params).then(() => {
+  // here we make the code unit-testable - i.e. by making the scan property stub-able
+  // this is not nice - and anyway when we move to ESM it won't work anymore because the module will be read-only -
+  // but for now, it allows us to unit test the module
+  module.exports.scan(params, cliArgs, localScanner).then(() => {
     callback();
   });
 }
diff --git a/test/unit/index.test.js b/test/unit/index.test.js
index de5745b4..f7f5b816 100644
--- a/test/unit/index.test.js
+++ b/test/unit/index.test.js
@@ -20,11 +20,63 @@
 
 const assert = require('assert');
 const index = require('../../src/index');
+const { spy, stub, restore } = require('sinon');
 
-describe('fromParam', function () {
-  it('should provide the correct identity', function () {
-    assert.deepEqual(index.fromParam(), [
-      '--from=ScannerNpm/' + require('../../package.json').version,
-    ]);
+describe('index', function () {
+  afterEach(restore);
+
+  describe('::fromParam', () => {
+    it('should provide the correct identity', function () {
+      assert.deepEqual(index.fromParam(), [
+        '--from=ScannerNpm/' + require('../../package.json').version,
+      ]);
+    });
+  });
+
+  describe('::cli', () => {
+    it('pass the expected arguments to the scan method', () => {
+      const parameters = {
+        foo: 'bar',
+      };
+      const cliArguments = ['--foo', 'bar'];
+
+      const scanStub = stub(index, 'scan').resolves();
+      const callbackSpy = spy(() => {
+        assert.equal(scanStub.callCount, 1);
+        assert.equal(scanStub.firstCall.args[0], parameters);
+        assert.equal(scanStub.firstCall.args[1], cliArguments);
+        assert.equal(
+          scanStub.firstCall.args[2],
+          false,
+          'the localScanner argument is passed as false',
+        );
+        assert.equal(callbackSpy.callCount, 1);
+      });
+
+      index.cli(cliArguments, parameters, callbackSpy);
+    });
+  });
+
+  describe('::customScanner', () => {
+    it('pass the expected arguments to the scan method', () => {
+      const parameters = {
+        foo: 'bar',
+      };
+
+      const scanStub = stub(index, 'scan').resolves(null);
+      const callbackSpy = spy(() => {
+        assert.equal(scanStub.callCount, 1);
+        assert.equal(scanStub.firstCall.args[0], parameters);
+        assert.equal(scanStub.firstCall.args[1].length, 0, 'no CLI arguments are passed');
+        assert.equal(
+          scanStub.firstCall.args[2],
+          true,
+          'the localScanner argument is passed as true',
+        );
+        assert.equal(callbackSpy.callCount, 1);
+      });
+
+      index.customScanner(parameters, callbackSpy);
+    });
   });
 });