Introducing SpectrAI
An autonomous pentest of a named application, external or internal, with verified evidence, a frozen report and correction retests. What it is, who it is for, and its limits.
What SpectrAI does#
SpectrAI performs a penetration test of a web application and its associated APIs, in an agreed environment. Two execution modes exist:
| Mode | From where | What you provide |
|---|---|---|
| External pentest | The Internet | The exact URL of the application and the proof that you control its domain |
| Internal scan | Your network, through a relay installed on site | A declared site, an agent installed on a machine of that site and a mandate: the authorised application, its optional subdomains, its HTTPS ports and a duration. Enabled by SpectrAI on your space |
In both cases, test agents work within the authorised perimeter, with consumption and duration limits managed by SpectrAI. Only demonstrated weaknesses are published, each with its evidence. The report is a frozen document, exportable as PDF, and each report entitles you to two correction retest batches within sixty days.
Who it is for#
- SMEs and mid-sized companies that want a test with evidence of their applications exposed on the Internet or of their private services.
- Security firms, MSSPs, MSPs and managed service providers that deliver these tests under their own brand, for several clients, from a dedicated console.
How it works#
- You register the application (its target) and prove that you control its domain, or you install a relay in your network.
- You describe the Guidance: attack surface, priorities, strategy and prohibited techniques, evidence requirements, API documents.
- You prepare the pentest, attest the authorisation and launch it.
- You follow the activity during the test.
- You receive the verified findings, their evidence, the attack paths and the report.
- You fix, then you launch your retest batches.
The detail of each step is in Your first pentest.
Limits of SpectrAI#
- SpectrAI provides neither live monitoring nor a monthly subscription that can be cancelled at any time: an order covers one full evaluation, or two over twelve months.
- SpectrAI issues neither a certification nor a regulatory audit. The NIS2 index classifies the evidence; it does not attest compliance.
- SpectrAI does not test bare IP addresses, code repositories or source code: only named web applications are covered.
- The perimeter never widens according to what the agents encounter during the test.
Where the product is#
The application is at app.spectr-ai.eu. The public pages on spectr-ai.eu describe the offers, the methodology and a sample report. SpectrAI is a rootzero product; the legal publisher is Thucy SARL (see the legal notice).