Skip to content
Prepare my pentest

Correction retests

Have your fixes verified with the two retest batches included within sixty days of each report: prepare a batch, launch it, read its verdict and understand its limits.

How-to guide · Customers2 min read

Markdown versionOpen in ChatGPTOpen in Claude

What is included#

Each report entitles you to two correction retest batches, within the sixty days following its publication. A batch groups the fixed findings you want to have verified. Batches are distinct from evaluations: they never consume the second evaluation of an annual programme.

There is no cap on the number of fixes in a batch. The rights of older missions follow their original contract.

Prepare a batch#

  1. In the pentest page or in Findings, select the fixed findings.
  2. Choose Prepare a retest batch. SpectrAI prepares a targeted test with its Guidance for each finding.
  3. The preparation advances step by step and resumes without duplicates after an interruption; the progress is displayed.
  4. Review the prepared drafts, then accept the launch authorisation and launch the batch.

Drafts never launched can be cancelled: cancelling all the drafts of a batch frees it. Deleting a test already launched never restores the consumed right.

Read the verdict#

For each finding of the batch, the fix tracker displays the dated result of the counter-test:

VerdictMeaning
The vulnerability was not reproducedThe targeted test did not find the original finding again. This is an inconclusive result: it does not prove that the fix is correct.
The vulnerability is still presentThe finding was found again. The tracker flags it as reopened.

Time limits#

  • Retest window: sixty days after the publication of the report.
  • Reminder: a notification warns you when the window closes in 7 days and an included batch remains available.
  • After both batches are used up or the window closes, no additional fix is tested free of charge: a new order is required.

Retests and internal scans#

Batches apply in the same way to the reports of internal scans. The additional URLs proposed within the sixty-day window use a separate allowance, never a retest batch.