Glossary
The terms used in the application, the reports and this documentation, with their short definition and a link to the page that details them.
| Term | Definition |
|---|---|
| Agency | A partner firm (or the SpectrAI house agency) that manages several client spaces from its console. See Console and client spaces. |
| Agent (relay) | The software installed on a machine of your network for internal scans. See The relay. |
| Annual programme | Two full evaluations of the same application over twelve months, without automatic renewal. |
| Attack path | A demonstrated chain of findings, with the provenance of each step. See Attack paths. |
| Attempt | One execution of a pentest. Only the last successful, complete and consistent attempt is presented. |
| Authorisation attestation | The declaration you accept at launch: you own the addresses tested or hold the written authorisation of their owner. |
| Client space | The boundary between clients: a client's targets, pentests, findings, reports and team. |
| Console | An agency's workspace: overview, clients, missions, team and white label. |
| CVSS | The severity score of a finding. It structures the deliverable; it does not replace your risk analysis. |
| CWE | The classification of a finding's weakness. |
| Ownership proof | The demonstration that you control the domain of an external target, through an HTTPS file or a DNS TXT record. |
| Evaluation | The right to launch a full pentest. One per one-off pentest, two per annual programme. |
| Evidence | What demonstrates a finding: redacted HTTP requests and responses, proof of concept, artefacts. |
| Finding | A demonstrated weakness, published with its evidence. In the application, the page that lists them is called Findings. |
| Guidance | The versioned context given to the agents: attack surface, priorities, strategy and prohibited techniques, evidence requirements and stop conditions, API documents. |
| Guardrails | The optional instructions of a pentest: excluded paths, maximum requested rate, careful mode, start window (the only one enforced by the platform). |
| Inconclusive result | The verdict of a retest that did not find the original finding again. It does not prove that the fix is correct. |
| Mandate | The testing authorisation of an internal site: the application's hostname, subdomains included or not, HTTPS ports and validity period, in signed revisions. |
| Mission | In an agency's console, the execution right assigned to a client. |
| NIS2 index | A classification of the evidence according to selected controls of article 21 of NIS2. It does not attest compliance. |
| Pentest | A dated mission on a target. In the application, the Pentests page. |
| Relay | The arrangement that allows testing from inside your network: an agent installed on site and a testing authorisation. |
| Report | The frozen snapshot of a completed pentest, published automatically, exportable as PDF. |
| Resume | A new attempt on the same mission after an eligible interruption. |
| Retest batch | A set of fixes to have verified after a report. Two batches included per report, within sixty days. |
| Second factor | The authenticator app or the e-mail code requested after the password. |
| Site | An internal network declared in Sites and agents by its private IPv4 ranges, where an agent is installed. |
| Target | A web application named by its exact URL, registered once and tested several times. |
| White label | The delivery of the reports and the client space under a partner's name, logo and, optionally, domain. |