Launch a pentest

Prerequisites#

• A target with a valid ownership proof and an active Guidance.
• An available evaluation (one-off pentest or annual programme), or a retest batch for a retest.
• The administrator or member role in the client space.

The target's scope#

The target page lists the authorised URLs and subdomains: the exact URL registered, plus the HTTPS URLs you add under the verified domain. It also accepts explicit exclusions: HTTPS paths or hosts that must stay out of the pentest. Nothing is added to the scope by discovery during the test.

Preparing#

1. In Pentests, choose Prepare a pentest, then the target.
2. Choose and order the authorised URLs: the order states your priorities.
3. Provide dedicated test accounts if needed (see Write the Guidance).
4. Set the guardrails if you wish: excluded paths (a test instruction, with no network block), maximum requested rate (1 to 50 requests per second, with no network guarantee), careful mode for production (read operations and test data preferred; changes remain possible), and the start window (days, hours, time zone), the only limit enforced by the platform.
5. Check the Guidance that will be used: it is the target's active version.

The draft is kept: you can come back to complete it.

Attesting the authorisation#

Before the launch, you attest, on behalf of your organisation:

1. that you are entitled to commit it and to authorise this test;
2. that it owns the addresses tested or holds the written and prior authorisation of their owner, valid for the whole duration of the test;
3. that, where necessary, the agreement of the third parties concerned (host, cloud or SaaS provider, CDN, web application firewall) has been obtained and their testing rules are respected;
4. that you understand the test may create or modify test data, trigger security alerts or temporarily slow the application down, and that recent backups exist;
5. that it answers for the accuracy of this authorisation, will provide written proof of it on request and accepts that the test be suspended at any time.

Launching#

At launch, SpectrAI rechecks in the database the tenant, the role, the quota, the target, the freshness of the proof (under 5 minutes), the Guidance, the URLs and the state of the pentest, then queues the mission. An available evaluation is deducted at that moment; a valid retest deducts none.

The platform runs pentests one after the other: yours may wait its turn. The pentest page shows its phase.

What is deducted, what is returned#

Scheduled pentests#

From the target page, you can schedule a recurring pentest, every month or every quarter, with its level, its scope and its first launch date, accepting the authorisation for every launch of the schedule. An evaluation is deducted at each launch; a reminder is sent 3 days before. The schedule pauses, with a notification, if no evaluation is available, if the ownership proof has expired, if the Guidance is missing or if the authorisation is no longer valid. Scheduled pentests receive no test accounts.

After the launch#

What happens on your application is described in During the test; the progress in Follow the activity.