Understand AI pentesting.

With SpectrAI, you agree the application and environment, verify the domain, provide accounts, define exclusions and authorise launch. For a private application, a relay reaches only authorised services from your network.

Agents explore accessible workflows and test hypotheses within this scope. Findings are assessed and reports published automatically. Evidence must demonstrate each published finding; the report also records limitations. This verification does not guarantee the absence of false positives or remaining vulnerabilities.

Document entry points, test accounts, roles, authorised test data and prohibited operations. For multi-tenant SaaS, define test workspaces and expected separation between users and organisations. An accessible API does not automatically expose every business workflow.

The scope distinguishes tested surfaces, areas blocked by missing access and exclusions. Source code, repositories, bare IP addresses, social engineering and physical testing are outside the SpectrAI offer described here.

For each published vulnerability, expect an affected asset, explained impact, justified severity, reproduction steps and remediation advice. Contextualised requests and responses help developers understand the result. A summary alone does not demonstrate testing depth.

The SpectrAI sample report illustrates a deliverable rather than predicting results for your application. Two retest batches included within sixty days of each report verify requested fixes. They are separate from a new full evaluation.

A time-bounded test cannot demonstrate that an application is secure. Unusual business logic, a critical architecture or a specific requirement may justify specialist human expertise and a separate source code review. Ask the report’s recipient what evidence they require before ordering.

The AI label alone does not establish better coverage, a lower price or guaranteed delivery. Compare proposals with the same scope, access and deliverables. A report does not constitute compliance certification.

Before providing access, establish the model provider, shared data, processing locations, retention and stopping controls. A product developed in France does not mean all data remains in France.

• Who authorises the target, accounts and operations?
• What evidence accompanies each finding, and how is it assessed?
• Which surfaces are excluded or might remain untested?
• Who receives data, and how are secrets handled?
• Which retests, debrief and terms appear in the proposal?
• For an MSP: who invoices, supports the client and authorises the engagement?