01The offers
Choose a one-off pentest or an annual programme.
02 Your need
Find the right offer.
An offer covers one application and its associated APIs in an agreed environment. Your choice is carried into your proposal request.
| Your situation | Our recommendation | Request a proposal |
|---|---|---|
| One application, evaluated once | One-off pentest One complete application evaluation, automated evidence verification and two retest batches within 60 days of the report. | Request a proposal |
| One application, twice a year | Annual programme Two evaluations of the same application to assess its security at two points in the year. Retests of your fixes are included separately. | Request a proposal |
| Several applications, SSO, MFA or VPN | On quotation A quote tailored to several applications, specific access requirements or internal sites served by a relay. | Request a proposal |
| A consultancy or an MSP | Partner programme One order per customer and application, a 30% partner discount and reports with your branding. | Request a proposal |
03 One-off or annual
Compare the two offers.
Each offer covers one application and its associated APIs in an agreed environment. The price is set out in the proposal, once the scope is confirmed.
- Before a production release
One-off pentest
Per application, associated APIs and agreed environment
Have your application and APIs tested before a production release or to address a customer’s security request.
- One full evaluation
- Autonomous testing and automated evidence verification
- Prioritised report and debrief
- Two retest batches within 60 days of the report
- Authenticated testing with your dedicated accounts
- Attack chains when they are demonstrated
- PDF report: impact, CVSS, CWE, recommendations
Paid on order, once you accept the proposal.
Prepare my pentest Scope confirmed before ordering - For an application that keeps changing
Annual programme
Per application per year · twelve-month commitment
Two full evaluations of the same application: one at the start, then a second during the year to assess changes.
- Two full evaluations over twelve months
- A new report for each evaluation
- Evidence and recommendations each time
- Two retest batches after each report
- Results history and remediation tracking
- Client workspace open for the twelve months
- Second evaluation around month six or on the agreed date
Prepaid or twelve fixed monthly instalments. Annual commitment, no automatic renewal.
Choose the annual programme Scope confirmed before ordering
The offers at a glance
| SpectrAI offers compared: one-off pentest, annual programme and partner programme. | One-off pentest | Annual programme | MSP and consultancy partners |
|---|---|---|---|
| Full evaluations | 1 | 2 over 12 months | Depending on the offer chosen for each client |
| Remediation retests | 2 batches within 60 days | 2 batches within 60 days of each report | 2 batches within 60 days of each report |
| Deliverables | PDF report, exports, debrief | One report per evaluation, remediation history | Reports, portal and emails in your brand |
| Payment | On order | Prepaid or 12 fixed monthly instalments | By quote, no online payment |
| Commitment | None | 12 months, no automatic renewal | No minimum or platform fee |
| Price | Proposal after scoping | Proposal after scoping | Single 30% discount, resale price of your choice |
Fig. 3 · The twelve-month cycle
One-off pentest
- Pentest
- 2 retests · 60 d
Annual programme
- Pentest 1
- 2 retests · 60 d
- Pentest 2
- 2 retests · 60 d
Are your services on a private network?
Internal scans use a relay installed inside your network. You define authorised domains and exclusions; SpectrAI runs the tests and publishes the report automatically.
Prepare an internal scanMSPs, managed service providers and cybersecurity firms
A single 30% partner discount, with no minimum or platform fees. SpectrAI invoices the MSP; the MSP invoices its customer at its freely chosen price.
See the partner programme04 In every report
A report to guide decisions and fixes.
A risk summary for leadership. Priorities and recommendations for your technical team. The report also explains what was tested and the limits of the assessment.
-
Evidence for every published vulnerability
Get reproduction steps and evidence demonstrating the impact. Evidence verification and report publication are automated.
-
Corrections and retests
Two correction retest batches within 60 days of each report. They never consume the second annual evaluation.
-
Export formats
PDF report, JSON, SARIF, CSV and Markdown exports, revocable read-only share link.
05 Ordering
What happens after your request.
You know the scope, deliverables and terms before committing. Testing never starts without your authorisation.
- 01
Explain your objective
Tell us which application you need tested, why and by when.
- 02
Agree the scope
We clarify roles, access, environment and testing rules.
- 03
Receive a proposal
Review the service, deliverables, schedule and commercial terms.
- 04
Confirm the engagement
Approve the quote, authorisation and agreed payment arrangements.
- 05
Get actionable results
Your team receives the evidence and recommendations, implements fixes and requests the included retests.
06 Questions
Frequently asked questions.
How do I order?
Start with a pentest or demonstration enquiry. We confirm the application, scope, access and schedule together, then send you a proposal.
What is an application?
One application and its associated APIs in an agreed environment. Scoping defines domains, user roles and workflows. Internal services are reached through the relay installed inside your network; the site scope and exclusions are defined before the scan.
What does the deliverable contain?
Actual coverage, automatically verified results, evidence, prioritised risks and recommendations, with a presentation of the results.
How long does a pentest take?
Duration depends on the application, access and scenarios. The schedule is set out in the proposal before work begins.
What does the retest include?
Two correction verification batches within 60 days of each report. These retests are separate from a complete new evaluation and never consume the second annual evaluation.
What does the annual programme include?
Two full evaluations of the same application over twelve months: one at the start, the other around six months or on the agreed date. Each report includes two batches of retests within 60 days. The contract runs for twelve months, paid upfront or in twelve fixed monthly instalments, with no automatic renewal. Testing takes place on the scheduled dates; daily monitoring is not included.
How do I test my internal services?
Install the SpectrAI relay using the command provided in your console. Define the site domain, authorised subdomains and exclusions, then launch the scan. Agents test that scope from inside your network and publish the report automatically. The relay must remain available during testing.
I am a security firm or an MSP: can I resell SpectrAI?
Yes. Contact us to discuss your partnership project. The MSP owns its customer relationship and sets its resale price. Partner terms are agreed during our conversation.
Have your application tested.
Tell us the application, your goal and your preferred date. We agree the scope and schedule with you before you place an order.