# Introducing SpectrAI

> An autonomous pentest of a named application, external or internal, with verified evidence, a frozen report and correction retests. What it is, who it is for, and its limits.

## What SpectrAI does

SpectrAI performs a penetration test of a web application and its associated APIs, in an agreed environment. Two execution modes exist:

| Mode | From where | What you provide |
|---|---|---|
| External pentest | The Internet | The exact URL of the application and the proof that you control its domain |
| Internal scan | Your network, through a relay installed on site | A declared site, an agent installed on a machine of that site and a mandate: the authorised application, its optional subdomains, its HTTPS ports and a duration. Enabled by SpectrAI on your space |

In both cases, test agents work within the authorised perimeter, with consumption and duration limits managed by SpectrAI. Only demonstrated weaknesses are published, each with its evidence. The report is a frozen document, exportable as PDF, and each report entitles you to two correction retest batches within sixty days.

## Who it is for

- SMEs and mid-sized companies that want a test with evidence of their applications exposed on the Internet or of their private services.
- Security firms, MSSPs, MSPs and managed service providers that deliver these tests under their own brand, for several clients, from a dedicated console.

## How it works

1. You register the application (its target) and prove that you control its domain, or you install a relay in your network.
2. You describe the Guidance: attack surface, priorities, strategy and prohibited techniques, evidence requirements, API documents.
3. You prepare the pentest, attest the authorisation and launch it.
4. You follow the activity during the test.
5. You receive the verified findings, their evidence, the attack paths and the report.
6. You fix, then you launch your retest batches.

The detail of each step is in [Your first pentest](https://docs.spectr-ai.eu/en/demarrer/premier-pentest).

## Limits of SpectrAI

- SpectrAI provides neither live monitoring nor a monthly subscription that can be cancelled at any time: an order covers one full evaluation, or two over twelve months.
- SpectrAI issues neither a certification nor a regulatory audit. The NIS2 index classifies the evidence; it does not attest compliance.
- SpectrAI does not test bare IP addresses, code repositories or source code: only named web applications are covered.
- The perimeter never widens according to what the agents encounter during the test.

> [!IMPORTANT]
> Finding assessment and report publication are fully autonomous. Nobody proofreads or holds back a report before its delivery: what you read is what the automatic checks of evidence, perimeter and consistency have let through.

## Where the product is

The application is at [app.spectr-ai.eu](https://app.spectr-ai.eu). The public pages on [spectr-ai.eu](https://spectr-ai.eu/en) describe the [offers](https://spectr-ai.eu/en/offres), the [methodology](https://spectr-ai.eu/en/methodologie) and a [sample report](https://spectr-ai.eu/en/exemple-de-rapport). SpectrAI is a rootzero product; the legal publisher is Thucy SARL (see the [legal notice](https://spectr-ai.eu/en/mentions-legales)).

---

https://docs.spectr-ai.eu/en/demarrer/presentation