Featured research CVE-2026-81963 Local privilege escalation in the Windows Update Stack through link following Lire en français FR
Contact

Autonomous web and API pentesting

SpectrAI by rootzero

Automated web application and API pentesting

Agents test your web applications and APIs within the scope you authorise. Every published finding ships with the request and the response that demonstrate it.

Prepare my pentest Go to spectr-ai.eu

For product teams, IT leaders and security managers.

Decisions your team can make

Know what can be exploited

Findings demonstrated by the observed request and response, verified automatically, with their impact.

Focus remediation

Evidence and a recommendation for every published finding.

Check the fixes

Targeted retests to verify remediation after the report.

01In short

SpectrAI follows the cycle of an application penetration test: hypothesis, attempt, automatically verified proof, automatically published report. Once you fix the issue, the re-test replays the same proof.

Targets
Web applications and APIs, internal network on request
Formats
PDF, JSON, SARIF, CSV, Markdown
Plans
One-off pentest or yearly programme (2 assessments)
Partners
White-label resale for MSPs and consultancies
SpectrAI / app.example.comAuthorised scope

From test to evidence

→ POST /preview

{{7*8}}HTTP 200 56

Request and response captured

Impact verified before publication

Documented finding

Server-side template injection

Evidence · impact · remediation · re-test

9.3CVSS 4.0
Workflow illustration. Fictional data.

02How it works

What SpectrAI does, step by step.

  1. Declared scope

    You name the application and the environment. Agents stay inside that scope and every run starts at your request.

  2. One proof per finding

    A vulnerability is published with its demonstration: request, observed response, impact and remediation.

  3. Automatic verification

    Each finding is verified automatically against the request and the response that demonstrate it. The report is then published automatically.

  4. Output formats

    PDF report, JSON, SARIF, CSV and Markdown exports, revocable share link, fix re-tests.

Use cases and deliverables

When to choose this product

  • Prepare a launch or a significant release.
  • Give developers fixes they can verify.
  • Share pentest results with a customer or your leadership team.

What you receive

  • A report to share results and priorities.
  • Technical evidence to reproduce and fix findings.
  • A handover and agreed retest arrangements.

Product direction In development

Pentesting will follow each change.

A new site, an exposed port, a change in state: our goal is to restart an agent with context from previous scans to investigate what changed.

  1. Detect the change

    An asset appears, a service opens or a configuration changes within the authorised scope.

  2. Resume with context

    The agent would recover assets, findings, evidence, fixes and avenues already examined in earlier scans.

  3. Test what changed

    The investigation would use that context to examine the change, produce new evidence and reassess attack paths.

Target scenario, shown for illustration
  • portal.example.comNew site
  • api.example.com:8443New port
  • auth.example.comState changed

Context from previous scans

Assets · findings · evidence · fixes

Focused investigation

The next pass would enrich the history of the same scope.

The current offer includes scoped assessments and fix retests. Automatic change-triggered testing with retained context is a development direction.

Discuss continuous pentesting

03Questions

Frequently asked questions

Who makes SpectrAI?

SpectrAI is a rootzero product. It is designed, built and run by the rootzero team in France.

How do I get started?

A first call lets us scope your perimeter and goals. Write to us to arrange the setup.

What should I prepare for the first conversation?

Tell us the application, environment, user roles and preferred date. We agree the scope and service before any testing starts.

How do I get a proposal?

Describe your needs and scope. We agree arrangements, schedule and price with you before any commitment.

Choosing your approach

SpectrAI or an expert-led pentest?

Compare the tests supported by SpectrAI with the scope of an engagement with a pentester.

SpectrAI / Product

Automated application pentesting

SpectrAI tests your web applications and APIs within an authorised scope. Choose it to run assessments on your schedule and replay evidence after fixes. Each published finding is verified automatically and comes with the request and the response that demonstrate it, then the report is published automatically.

Explore SpectrAI
rootzero / Service

An engagement with our experts

A pentest is scoped with you around an objective and a schedule. It can cover web, APIs, mobile, internal networks or Active Directory, with a handover and remediation priorities.

Explore pentesting services

Further reading

The method, open to inspection.

Our public research and guides on these topics: the mechanisms, the evidence and the limits of each analysis.

Explore all publications

Evaluate SpectrAI on your scope.

Tell us the application, environment, user roles and preferred date. We agree the scope and service before any testing starts.

Prepare my pentest

+Same house

The other rootzero products

    Quick access