# Launch a pentest

> Prepare a pentest on a verified target: choose and order the authorised URLs, provide test accounts, set the guardrails, accept the five attestations, launch, and understand what is deducted.

## Prerequisites

- A target with a valid ownership proof and an active Guidance.
- An available evaluation (one-off pentest or annual programme), or a retest batch for a retest.
- The administrator or member role in the client space.

## The target's scope

The target page lists the authorised **URLs and subdomains**: the exact URL registered, plus the HTTPS URLs you add under the verified domain. It also accepts **explicit exclusions**: HTTPS paths or hosts that must stay out of the pentest. Nothing is added to the scope by discovery during the test.

## Preparing

1. In **Pentests**, choose **Prepare a pentest**, then the target.
2. Choose and order the authorised URLs: the order states your priorities.
3. Provide dedicated test accounts if needed (see [Write the Guidance](https://docs.spectr-ai.eu/en/pentest-externe/guidance)).
4. Set the **guardrails** if you wish: excluded paths (a test instruction, with no network block), maximum requested rate (1 to 50 requests per second, with no network guarantee), careful mode for production (read operations and test data preferred; changes remain possible), and the start window (days, hours, time zone), the only limit enforced by the platform.
5. Check the Guidance that will be used: it is the target's active version.

The draft is kept: you can come back to complete it.

## Attesting the authorisation

Before the launch, you attest, on behalf of your organisation:

1. that you are entitled to commit it and to authorise this test;
2. that it owns the addresses tested or holds the written and prior authorisation of their owner, valid for the whole duration of the test;
3. that, where necessary, the agreement of the third parties concerned (host, cloud or SaaS provider, CDN, web application firewall) has been obtained and their testing rules are respected;
4. that you understand the test may create or modify test data, trigger security alerts or temporarily slow the application down, and that recent backups exist;
5. that it answers for the accuracy of this authorisation, will provide written proof of it on request and accepts that the test be suspended at any time.

> [!IMPORTANT]
> This attestation shown at launch does not replace a separate signed legal authorisation between you and the owner of the application. Keep that authorisation on your side.

## Launching

At launch, SpectrAI rechecks in the database the tenant, the role, the quota, the target, the freshness of the proof (under 5 minutes), the Guidance, the URLs and the state of the pentest, then queues the mission. An available evaluation is deducted at that moment; a valid retest deducts none.

The platform runs pentests one after the other: yours may wait its turn. The pentest page shows its phase.

## What is deducted, what is returned

| Situation | Effect on the evaluation |
|---|---|
| Launch of a full pentest | One evaluation is consumed |
| Launch of a correction retest | No evaluation; the retest batch is used |
| Cancellation before the effective start | The evaluation is returned |
| Failure for a platform cause, without a published report or possible resume | The evaluation is returned |
| Report published | The evaluation is consumed |
| Relay loss during an internal scan | Nothing is returned: the relaunch is covered |

## Scheduled pentests

From the target page, you can schedule a recurring pentest, every month or every quarter, with its level, its scope and its first launch date, accepting the authorisation for every launch of the schedule. An evaluation is deducted at each launch; a reminder is sent 3 days before. The schedule pauses, with a notification, if no evaluation is available, if the ownership proof has expired, if the Guidance is missing or if the authorisation is no longer valid. Scheduled pentests receive no test accounts.

## After the launch

What happens on your application is described in [During the test](https://docs.spectr-ai.eu/en/pentest-externe/pendant-le-test); the progress in [Follow the activity](https://docs.spectr-ai.eu/en/pentest-externe/suivre-l-activite).

---

https://docs.spectr-ai.eu/en/pentest-externe/lancer-un-pentest