Key concepts

The model in one picture#

Agency (partner firm, or the SpectrAI house agency)
└── Client space (the boundary between clients)
    └── Target (one application, registered once)
        ├── Ownership proof (HTTPS file or DNS TXT record)
        ├── Guidance (context reused from one test to the next)
        └── Pentest (one dated mission)
            └── Attempt(s) (initial execution, then a possible resume)
                ├── live activity
                ├── findings and evidence
                ├── derived attack paths
                └── frozen report

A target is not a pentest: an application is registered once and can be tested several times. A resume creates a new attempt on the same mission.

Target#

A target is a web application named by its exact URL (for example https://app.exemple.fr), with its associated APIs. Its page lists the authorised HTTPS URLs under the verified domain and the explicit exclusions. It belongs to a client space. Bare IP addresses are not targets.

Ownership proof#

Before any external pentest, you prove that you control the target's domain, through a file published over HTTPS on the exact origin or through a DNS TXT record on the parent domain. The verification code is valid for 72 hours; an accepted proof remains valid for 90 days. See Verify the domain.

For an internal scan, the testing authorisation set on the site (the mandate: hostname, optional subdomains, HTTPS ports, duration) plays this role. See The testing mandate.

Guidance#

The Guidance is the context you give the agents: attack surface, priorities, strategy, validation rules, API documents and test accounts. It is versioned; each pentest starts from the active Guidance of its target. It can never widen the verified URLs. See Write the Guidance.

Pentest and attempt#

A pentest is a dated mission on a target, with its ordered authorised URLs and, if needed, test accounts. Its execution is an attempt. If an attempt is interrupted for an eligible cause, a resume creates a second attempt on the same mission. Only the results of the last successful, complete and consistent attempt are presented to you.

Findings and evidence#

A finding is a demonstrated weakness. It carries a severity (CVSS), a classification (CWE), a description, an impact, a recommendation and its evidence: redacted HTTP requests and responses, proof of concept or artefacts. What has not been demonstrated is not published. See Findings and evidence.

Attack paths#

Proven findings are linked into attack paths, with the provenance of each step. They are derived from the evidence; they add no assumption. See Attack paths.

Report#

The report is a frozen snapshot of a completed pentest: data, brand and limits are fixed there at publication time. It is published automatically, even without any finding, and exports as PDF. See The report.

Retest batches#

After each report, two correction retest batches are included for sixty days. A batch groups the fixes you want to have verified. See Correction retests.

Evaluation#

An evaluation is the right to launch a full pentest. A one-off pentest contains one; an annual programme contains two over twelve months. Retest batches are distinct from evaluations. See The catalogue.

Client space, agency, console#

A client space isolates a client's data. An agency (partner firm) manages several client spaces from its console and enters a space to work there as the client itself. Direct clients are attached to the SpectrAI house agency. See Console and client spaces.