# External and internal pentesting offers · SpectrAI

> One-off pentests, an annual programme and internal scans through a relay. Compare SpectrAI scope, evidence, reports and retests.

URL: https://spectr-ai.eu/en/offres · Language: English · Publisher: rootzero (Thucy SARL)

1.  [SpectrAI](https://spectr-ai.eu/en)
2.  Plans

**01** The offers

# Choose a *one-off* pentest or an annual programme.

One pentest or two evaluations a year for your application. For private services, internal scans use a relay installed inside your network. The scope is agreed before you place an order.

[Compare the offers](#comparer) [View a sample report](https://spectr-ai.eu/en/exemple-de-rapport)

**02** Your need

## Find the right *offer*.

An offer covers one application and its associated APIs in an agreed environment. Your choice is carried into your proposal request.

| Your situation | Our recommendation |  |
| --- | --- | --- |
| One application, evaluated once | **One-off pentest** One complete application evaluation, automated evidence verification and two retest batches within 60 days of the report. | [Request a proposal](https://spectr-ai.eu/en/contact?request=pentest) |
| One application, twice a year | **Annual programme** Two evaluations of the same application to assess its security at two points in the year. Retests of your fixes are included separately. | [Request a proposal](https://spectr-ai.eu/en/contact?request=annual) |
| Several applications, SSO, MFA or VPN | **On quotation** A quote tailored to several applications, specific access requirements or internal sites served by a relay. | [Request a proposal](https://spectr-ai.eu/en/contact?request=enterprise) |
| A consultancy or an MSP | **Partner programme** One order per customer and application, a 30% partner discount and reports with your branding. | [Request a proposal](https://spectr-ai.eu/en/partenaires) |

**03** One-off or annual

## Compare the two *offers*.

Each offer covers one application and its associated APIs in an agreed environment. The price is set out in the proposal, once the scope is confirmed.

-   Before a production release 
    
    ### One-off pentest
    
    Per application, associated APIs and agreed environment
    
    Have your application and APIs tested before a production release or to address a customer’s security request.
    
    -   One full evaluation
    -   Autonomous testing and automated evidence verification
    -   Prioritised report and debrief
    -   Two retest batches within 60 days of the report
    -   Authenticated testing with your dedicated accounts
    -   Attack chains when they are demonstrated
    -   PDF report: impact, CVSS, CWE, recommendations
    
    Paid on order, once you accept the proposal.
    
    [Prepare my pentest](https://spectr-ai.eu/en/contact?request=pentest) Scope confirmed before ordering
    
-   For an application that keeps changing 
    
    ### Annual programme
    
    Per application per year · twelve-month commitment
    
    Two full evaluations of the same application: one at the start, then a second during the year to assess changes.
    
    -   Two full evaluations over twelve months
    -   A new report for each evaluation
    -   Evidence and recommendations each time
    -   Two retest batches after each report
    -   Results history and remediation tracking
    -   Client workspace open for the twelve months
    -   Second evaluation around month six or on the agreed date
    
    Prepaid or twelve fixed monthly instalments. Annual commitment, no automatic renewal.
    
    [Choose the annual programme](https://spectr-ai.eu/en/contact?request=annual) Scope confirmed before ordering
    

### The offers at a glance

SpectrAI offers compared: one-off pentest, annual programme and partner programme.
|  | One-off pentest | Annual programme | MSP and consultancy partners |
| --- | --- | --- | --- |
| Full evaluations | 1 | 2 over 12 months | Depending on the offer chosen for each client |
| Remediation retests | 2 batches within 60 days | 2 batches within 60 days of each report | 2 batches within 60 days of each report |
| Deliverables | PDF report, exports, debrief | One report per evaluation, remediation history | Reports, portal and emails in your brand |
| Payment | On order | Prepaid or 12 fixed monthly instalments | By quote, no online payment |
| Commitment | None | 12 months, no automatic renewal | No minimum or platform fee |
| Price | Proposal after scoping | Proposal after scoping | Single 30% discount, resale price of your choice |

Fig. 3 · The twelve-month cycle

One-off pentest

1.  Pentest
2.  2 retests · 60 d

Annual programme

1.  Pentest 1
2.  2 retests · 60 d
3.  Pentest 2
4.  2 retests · 60 d

Each pentest ends with a report, followed by two retest batches within sixty days. The agents test, your team fixes, the retests verify. The annual programme’s second evaluation takes place around month six or on the agreed date; retests never consume it.

### Are your services on a private network?

Internal scans use a relay installed inside your network. You define authorised domains and exclusions; SpectrAI runs the tests and publishes the report automatically.

[Prepare an internal scan](https://spectr-ai.eu/en/contact?request=internal)

MSPs, managed service providers and cybersecurity firms

A single 30% partner discount, with no minimum or platform fees. SpectrAI invoices the MSP; the MSP invoices its customer at its freely chosen price.

[See the partner programme](https://spectr-ai.eu/en/partenaires)

**04** In every report

## A report to guide decisions and *fixes*.

A risk summary for leadership. Priorities and recommendations for your technical team. The report also explains what was tested and the limits of the assessment.

-   ### Evidence for every published vulnerability
    
    Get reproduction steps and evidence demonstrating the impact. Evidence verification and report publication are automated.
    
-   ### Corrections and retests
    
    Two correction retest batches within 60 days of each report. They never consume the second annual evaluation.
    
-   ### Export formats
    
    PDF report, JSON, SARIF, CSV and Markdown exports, revocable read-only share link.
    

**05** Ordering

## What happens after your *request*.

You know the scope, deliverables and terms before committing. Testing never starts without your authorisation.

1.  01
    
    ### Explain your objective
    
    Tell us which application you need tested, why and by when.
    
2.  02
    
    ### Agree the scope
    
    We clarify roles, access, environment and testing rules.
    
3.  03
    
    ### Receive a proposal
    
    Review the service, deliverables, schedule and commercial terms.
    
4.  04
    
    ### Confirm the engagement
    
    Approve the quote, authorisation and agreed payment arrangements.
    
5.  05
    
    ### Get actionable results
    
    Your team receives the evidence and recommendations, implements fixes and requests the included retests.
    

**06** Questions

## Frequently asked *questions*.

How do I order?

Start with a pentest or demonstration enquiry. We confirm the application, scope, access and schedule together, then send you a proposal.

What is an application?

One application and its associated APIs in an agreed environment. Scoping defines domains, user roles and workflows. Internal services are reached through the relay installed inside your network; the site scope and exclusions are defined before the scan.

What does the deliverable contain?

Actual coverage, automatically verified results, evidence, prioritised risks and recommendations, with a presentation of the results.

How long does a pentest take?

Duration depends on the application, access and scenarios. The schedule is set out in the proposal before work begins.

What does the retest include?

Two correction verification batches within 60 days of each report. These retests are separate from a complete new evaluation and never consume the second annual evaluation.

What does the annual programme include?

Two full evaluations of the same application over twelve months: one at the start, the other around six months or on the agreed date. Each report includes two batches of retests within 60 days. The contract runs for twelve months, paid upfront or in twelve fixed monthly instalments, with no automatic renewal. Testing takes place on the scheduled dates; daily monitoring is not included.

How do I test my internal services?

Install the SpectrAI relay using the command provided in your console. Define the site domain, authorised subdomains and exclusions, then launch the scan. Agents test that scope from inside your network and publish the report automatically. The relay must remain available during testing.

I am a security firm or an MSP: can I resell SpectrAI?

Yes. Contact us to discuss your partnership project. The MSP owns its customer relationship and sets its resale price. Partner terms are agreed during our conversation.

## Have your *application* tested.

Tell us the application, your goal and your preferred date. We agree the scope and schedule with you before you place an order.

[Prepare my pentest](https://spectr-ai.eu/en/contact?request=pentest) [View a sample report](https://spectr-ai.eu/en/exemple-de-rapport)