SpectrAI
Test your applications and APIs
Findings demonstrated by the observed request and response, verified automatically, with their impact.
See deliverables and getting startedOur cybersecurity software
An application to release, exposure to monitor, a suspicious email or leaked credentials: start with the problem you need to solve.
Compare the outcomes you need.
DataShield
Map your Internet exposure
Bring together domains and services visible from the Internet.
See deliverables and getting startedMailSentinel
Analyse a suspicious email
Bring together the message, link and attachment evidence.
See deliverables and getting startedBreachScan
Monitor data leaks
Connect observed leaks to your domains and work credentials.
See deliverables and getting startedChoosing your approach
SpectrAI or an expert-led pentest?
Compare the tests supported by SpectrAI with the scope of an engagement with a pentester.
Automated application pentesting
SpectrAI tests your web applications and APIs within an authorised scope. Choose it to run assessments on your schedule and replay evidence after fixes. Each published finding is verified automatically and comes with the request and the response that demonstrate it, then the report is published automatically.
Explore SpectrAIAn engagement with our experts
A pentest is scoped with you around an objective and a schedule. It can cover web, APIs, mobile, internal networks or Active Directory, with a handover and remediation priorities.
Explore pentesting services01Autonomous web and API pentesting
SpectrAI
SpectrAI by rootzeroAutomated web application and API pentesting
Agents test your web applications and APIs within the scope you authorise. Every published finding ships with the request and the response that demonstrate it.
Our direction towards continuous pentesting- Targets
- Web applications and APIs, internal network on request
- Formats
- PDF, JSON, SARIF, CSV, Markdown
- Plans
- One-off pentest or yearly programme (2 assessments)
- Partners
- White-label resale for MSPs and consultancies
From test to evidence
→ POST /preview
{{7*8}}HTTP 200 56Request and response captured
Impact verified before publication
Documented finding
Server-side template injectionEvidence · impact · remediation · re-test
02Attack surface management
DataShield
DataShield by rootzeroInventory of Internet-exposed services
DataShield inventories what is exposed on the Internet under your name: subdomains, services, cloud storage, lookalike domains. It tells you when something changes.
- Frequency
- Daily scan
- Alerts
- Microsoft Teams, email
- Reporting
- Dashboard and consolidated report
- Getting started
- Free discovery scan delivered within 48 hours
Your external exposureexample.com
api.example.com vpn.example.com files.example.com staging.example.com
An exposure to investigate.
Accessible storage · archived evidence · recommended fix
03Suspicious email analysis
MailSentinel
MailSentinel by rootzeroSuspicious email analysis
Your staff forward a dubious email. MailSentinel replies with a verdict (legitimate, suspicious or malicious), the signals behind it and what to do next.
- Deployment
- No software to install
- Turnaround
- A few seconds per analysis
- Verdict
- Legitimate, suspicious or malicious
- Trial
- 30 days, assisted setup
04Data leak monitoring
BreachScan
BreachScan by rootzeroData leak monitoring
BreachScan monitors leaks that concern your organisation: compromised credentials, internal documents, published secrets, databases resold on forums.
- Monitoring
- Continuous
- Evidence
- Archived and timestamped
- Alerts
- With context
- Getting started
- Historical report within 72 hours, then continuous monitoring
From traces to action
Public repository
API_KEY=••••••••••••••7QXSecret linked to your organisation
Revoke the keyExposed credentials
j.martin@example.com:••••••••Timestamped source and evidence
Reset access