# MSPs: launch a white-label AI pentesting service · SpectrAI > Prepare AI pentesting resale: customer need, scope, authorisation, accounts, evidence, debrief and retests. A practical guide for MSPs and consultancies. URL: https://spectr-ai.eu/en/lancer-offre-pentest-msp · Language: English · Publisher: rootzero (Thucy SARL) [SpectrAI](https://spectr-ai.eu/en)MSPs: launch a white-label AI pentesting service Selection guide # Prepare your first partner *engagement*. Reselling cybersecurity services requires a clear customer outcome, method and division of responsibilities. For white-label AI pentesting, start with an application and a specific decision, then scope the engagement before offering a schedule. By the rootzero team · 4 November 2026 [Start with the customer’s need.](#besoin)[Separate resale from execution.](#modele)[Define an identifiable application.](#cadrage)[Confirm authorisation and data.](#autorisation)[Prepare to explain the evidence.](#livrable)[Measure a useful first engagement.](#pilote)[Use the scoping worksheet.](#trame) **01** Choosing a service ## Start with the customer’s *need*. A customer may need to evaluate an API before release, respond to a buyer’s request or verify remediation. Establish what they need to decide from the report. A feature list cannot replace that objective. Cybersecurity resale covers different services, including endpoint protection, monitoring, backup and assessment. A pentest is neither a SOC nor daily monitoring. Describe the need your offering addresses and the separate services still required. **02** Choosing a service ## Separate resale from *execution*. In the SpectrAI programme, partners retain the commercial relationship and set their resale price. SpectrAI invoices the partner, who invoices the customer. The portal, reports and emails can carry the consultancy’s brand. Verify applicable terms in the proposal. Customers should understand the method. Agents test the authorised scope, with automated assessment of findings and report publication. White labelling does not turn this into a human-led assessment or establish certification. **03** Choosing a service ## Define an identifiable *application*. Record the application, environment, exact domains and associated APIs. Provide test accounts and workflows for each role. For multi-tenant SaaS, identify demonstration organisations and expected isolation. For a private application, define the internal relay, authorised services and access contact. A relay does not imply a whole-network or Active Directory audit. Bare IP addresses, source code and repositories are outside the offer described here. - Business objective and report recipient. - Application, environment, domains and associated APIs. - Roles, test accounts and authorised data. - Exclusions, constraints, contact and stopping procedure. - Deliverables, debrief, retests and closure criteria. **04** Choosing a service ## Confirm authorisation and *data*. Establish who may authorise testing of each asset. Managing a service for a customer does not define every permitted operation. The mandate, domain-control evidence and exclusions must be ready before launch. Agree which access and data may be supplied, who receives evidence and how it is shared. Establish model providers, processing, locations, retention and rights in the applicable documents. French product development does not mean every processing operation takes place in France. **05** Choosing a service ## Prepare to explain the *evidence*. Review the sample report with whoever will present findings. They should explain impact, preconditions, reproduction, limitations and remediation advice. A demonstrated issue on one asset does not establish coverage of every customer workflow. Assign ownership of remediation and verification. The offer includes 2 retest batches within 60 days of each report. A remediation retest differs from testing a new application or conducting another full evaluation. The annual programme includes 2 evaluations over 12 months. **06** Choosing a service ## Measure a useful first *engagement*. Assess scoping, access, report comprehension and retests. Finding count alone is insufficient. No published finding does not demonstrate a secure application, while many findings do not establish usefulness. Track consultancy effort, customer questions, remediation ownership and blocked areas. Distinguish partner account creation, an accepted proposal and an engagement actually ordered. These stages have different commercial value. **07** Choosing a service ## Use the scoping *worksheet*. The downloadable worksheet helps prepare a first engagement. It is neither a quote, contract nor testing authorisation. Supply account secrets through the agreed access channel separately from this worksheet. Common questions ## Clarify your *choice*. Must a partner be a pentester? Partners should scope the need, obtain authorisation, explain the method and organise the debrief. Separate human expertise may still be necessary for the customer’s requirements. Does an engagement test every customer security product? No. Each proposal defines the application and authorised services. It does not automatically cover other applications, a whole network, source code or every device. How should resale pricing be prepared? Request a proposal for a defined scope and account for your scoping, support and debrief work. Partners set their customer price. An example cannot establish a price or commercial result. ## Examine the *references*. Published by rootzero, the maker of SpectrAI. These examples describe our offer and are not a market benchmark. - [OWASP Web Security Testing Guide 4.2](https://owasp.org/www-project-web-security-testing-guide/v42/) - [SpectrAI methodology](https://spectr-ai.eu/en/methodologie) - [SpectrAI sample report](https://spectr-ai.eu/en/exemple-de-rapport) - [SpectrAI partner programme](https://spectr-ai.eu/en/partenaires) - [About rootzero](https://rootzero.eu/en/about/) ### Continue your comparison. Move from definitions to selection criteria, deliverables and terms. [AI pentesting: definition, process and limitations](https://spectr-ai.eu/en/pentest-ia) ## Scope your next *pentest*. Business, MSP or consultancy: describe the application, access and deadline. We agree the proposal with you. [Review the plans](https://spectr-ai.eu/en/offres) [MSP and consultancy partner programme](https://spectr-ai.eu/en/partenaires) ## Prepare the scope with your *customer*. Download the worksheet: objective, assets, access, exclusions, contacts and deliverables. It supports scoping and does not authorise testing. [Download the scoping worksheet](https://spectr-ai.eu/ressources/cadrage-pentest-msp-en.md) ## Explore tools and *agents*. [Cybersecurity AI agents and multi-agent systems: uses, evidence and limits](https://rootzero.eu/en/research/cybersecurity-ai-agents-multi-agent/) [Follow articles and research through RSS](https://rootzero.eu/en/feeds/)