# Key concepts

> Target, ownership proof, Guidance, pentest, attempt, findings, evidence, attack paths, report, retests: how these objects fit together in SpectrAI.

## The model in one picture

```text
Agency (partner firm, or the SpectrAI house agency)
└── Client space (the boundary between clients)
    └── Target (one application, registered once)
        ├── Ownership proof (HTTPS file or DNS TXT record)
        ├── Guidance (context reused from one test to the next)
        └── Pentest (one dated mission)
            └── Attempt(s) (initial execution, then a possible resume)
                ├── live activity
                ├── findings and evidence
                ├── derived attack paths
                └── frozen report
```

A target is not a pentest: an application is registered once and can be tested several times. A resume creates a new attempt on the same mission.

## Target

A target is a web application named by its exact URL (for example `https://app.exemple.fr`), with its associated APIs. Its page lists the authorised HTTPS URLs under the verified domain and the explicit exclusions. It belongs to a client space. Bare IP addresses are not targets.

## Ownership proof

Before any external pentest, you prove that you control the target's domain, through a file published over HTTPS on the exact origin or through a DNS TXT record on the parent domain. The verification code is valid for 72 hours; an accepted proof remains valid for 90 days. See [Verify the domain](https://docs.spectr-ai.eu/en/pentest-externe/verifier-le-domaine).

For an internal scan, the testing authorisation set on the site (the mandate: hostname, optional subdomains, HTTPS ports, duration) plays this role. See [The testing mandate](https://docs.spectr-ai.eu/en/scans-internes/mandat-et-exclusions).

## Guidance

The Guidance is the context you give the agents: attack surface, priorities, strategy, validation rules, API documents and test accounts. It is versioned; each pentest starts from the active Guidance of its target. It can never widen the verified URLs. See [Write the Guidance](https://docs.spectr-ai.eu/en/pentest-externe/guidance).

## Pentest and attempt

A pentest is a dated mission on a target, with its ordered authorised URLs and, if needed, test accounts. Its execution is an attempt. If an attempt is interrupted for an eligible cause, a resume creates a second attempt on the same mission. Only the results of the last successful, complete and consistent attempt are presented to you.

## Findings and evidence

A finding is a demonstrated weakness. It carries a severity (CVSS), a classification (CWE), a description, an impact, a recommendation and its evidence: redacted HTTP requests and responses, proof of concept or artefacts. What has not been demonstrated is not published. See [Findings and evidence](https://docs.spectr-ai.eu/en/resultats/findings-et-preuves).

## Attack paths

Proven findings are linked into attack paths, with the provenance of each step. They are derived from the evidence; they add no assumption. See [Attack paths](https://docs.spectr-ai.eu/en/resultats/chemins-d-attaque).

## Report

The report is a frozen snapshot of a completed pentest: data, brand and limits are fixed there at publication time. It is published automatically, even without any finding, and exports as PDF. See [The report](https://docs.spectr-ai.eu/en/resultats/rapport).

## Retest batches

After each report, two correction retest batches are included for sixty days. A batch groups the fixes you want to have verified. See [Correction retests](https://docs.spectr-ai.eu/en/resultats/retests).

## Evaluation

An evaluation is the right to launch a full pentest. A one-off pentest contains one; an annual programme contains two over twelve months. Retest batches are distinct from evaluations. See [The catalogue](https://docs.spectr-ai.eu/en/offres-et-commandes/catalogue).

## Client space, agency, console

A client space isolates a client's data. An agency (partner firm) manages several client spaces from its console and enters a space to work there as the client itself. Direct clients are attached to the SpectrAI house agency. See [Console and client spaces](https://docs.spectr-ai.eu/en/partenaires/console).

---

https://docs.spectr-ai.eu/en/demarrer/concepts