Selection guide
Choose your testing method.
Start with the risk and deliverable you need to evaluate. A scanner helps detect weaknesses, a manual pentest applies specialist judgement and an AI pentest delegates testing decisions to agents. Their usefulness depends on access, context and evidence.
| Compare | Scanner | AI agent pentest | Manual pentest |
|---|---|---|---|
| Test selection | Configured rules and checks. | Agent decisions within tools and limits. | Specialist decisions supported by tools. |
| Evidence to request | Material to assess an alert. | Reproduction, impact and scope actually tested. | Reproduction, analysis and scope actually tested. |
| Business context | Depends on rules and configuration. | Depends on accessible workflows and interpretation of context. | Discussions with teams can deepen specific scenarios. |
| Price and timing | Depend on product and scope. | Depend on service and scope. | Depend on engagement and scope. |
01 Choosing a service
Start with your decision.
Before release, your team may need to evaluate an application and receive evidence to fix issues. A complex payment workflow or critical architecture may need dedicated human analysis. A scanner can complement these evaluations when monitoring known configurations across many assets.
OWASP presents security testing as techniques adapted to risk and the development lifecycle. Its guide does not certify a tool. Combining methods can be useful without every supplier delivering all those services.
02 Choosing a service
Compare the same scope.
Two quotes are not comparable if one covers public pages while the other includes accounts, roles and authenticated APIs. Describe the environment, domains, interfaces and exclusions. Ask how untested surfaces will be recorded.
For internal testing, network access alone does not define coverage. SpectrAI uses a relay to reach authorised applications and services. This offer should not be equated with a complete Active Directory or whole-network assessment.
03 Choosing a service
Read the evidence before choosing.
Open a sample finding. Could a developer understand the impact, reproduce the issue and identify a fix? Examine preconditions, redactions and the handling of duplicates, unconfirmed hypotheses and limitations.
SpectrAI assesses findings and evidence automatically. Its sample report lets you examine the format. Automatic publication does not replace a human review service when your organisation or the report’s recipient requires one.
04 Choosing a service
Compare the full cycle.
Useful cost includes scoping, access preparation, testing, reporting, debrief and verification of fixes. Check the retest window and distinguish a set of fixes from a new scope. Continuous testing does not specify a frequency without a contractual schedule.
SpectrAI offers a one-off evaluation or two full evaluations over twelve months. Two retest batches are included within sixty days of each report. The annual programme is not daily testing; terms and price appear in the proposal.
05 Choosing a service
For an MSP, define responsibilities.
A consultancy should explain its method, scope, deliverables and data handling to its client. White labelling customises presentation; it does not turn an automated engagement into a human-led assessment or change the findings.
Check client isolation, evidence provenance, authorisation, debrief, support and renewal terms. The partner programme separately describes these arrangements and invoicing between SpectrAI, the firm and its client.
Common questions
Clarify your choice.
Does AI pentesting replace a human pentester?
It depends on the need. Agents can execute a defined evaluation and produce evidence. Specialist human expertise remains relevant when the context, constraints or required method extend beyond that scope.
Is a scanner sufficient to provide security evidence to a client?
Ask what they require: scope, method, evidence, supplier identity and debrief. An alert list or score alone does not demonstrate application security.
Why is there no supplier ranking?
This framework covers selection criteria. Without a reproducible comparative test on the same scope, it cannot rank suppliers’ coverage, quality or value.
Examine the references.
Published by rootzero, the maker of SpectrAI. These examples describe our offer and are not a market benchmark.
Continue your comparison.
Move from definitions to selection criteria, deliverables and terms.
Scope your next pentest.
Business, MSP or consultancy: describe the application, access and deadline. We agree the proposal with you.