Send a host to a pentest

Attack Surface and SQUR Pentest share one account. A host you found can become a pentest target without retyping anything.

Start from a scan

1. Open your scan results (on asm.squr.ai or in the app under Attack Surface).
2. On the recommended target, or on any host in the list, click Verify exploitability on the host name on asm.squr.ai, or Launch Pentest in the app.
3. Sign in if you are not already. Both products use the same login.
4. You land on the pentest setup with the host filled in. Add credentials, roles and scope, then configure and launch the pentest.

What carries over

SQUR creates (or reuses) an app in your organization for the host. If the host already exists as an app, SQUR links it instead of creating a duplicate. The setup shows a summary titled what came over from the attack surface. It lists:

• the host as the target and its starting scope,
• the technology the scan detected (the tech stack),
• the scan's risk score, recorded as a note on the app,
• the scan's exposures, as unverified leads for the pentest.

Everything that is saved on the app is used by every later pentest of that app. If a number in the summary is unknown, it says unknown and not none.

Exposures stay separate from findings

On the app, scan exposures appear in a card named Attack surface exposures with an Unverified badge. They are read-only: you cannot dismiss, accept or retest them, because they have no lifecycle until a pentest tests them. The pentest uses them as leads. What it proves becomes a finding.

Sending the same host again replaces the stored exposures with the newest set.

Results flow back

When the pentest completes, its results are available in the app as usual. See Findings and Download report.

Whole portfolio instead of one host

If you want to decide which of your applications deserve a pentest, and how often, use the Pentest Program Planner. It can start from a scan.