> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Pentesting

> Run AI-driven penetration tests against configured web application targets

<Info>
  Pentesting is currently in beta and must be enabled for your company. If you do not see **Pentests** in the sidebar, contact your Corgea administrator or Corgea contact.
</Info>

Pentesting helps your team run AI-driven penetration tests against web application targets that you configure in Corgea. Use it to test running applications for authentication and authorization issues, business logic flaws, injection risks, and other exploitable behavior that may not be visible from source code alone.

## Targets

A target is a reusable pentest configuration. Each target includes a name, URL, optional credentials, optional instructions, and a default scan mode.

<Steps>
  <Step title="Open Pentests">
    In Corgea, select **Pentests** from the sidebar.
  </Step>

  <Step title="Create a target">
    Click **New target**, then enter the target name and URL.
  </Step>

  <Step title="Add optional context">
    Add credentials when the test should cover authenticated areas. Use **Additional instructions** for rules of engagement, scope exclusions, or endpoints the agents should focus on.
  </Step>

  <Step title="Choose a default scan mode">
    Select **Balanced** for a faster run or **Deep** for a more thorough assessment.
  </Step>
</Steps>

<Note>
  Only add targets that your organization is authorized to test. Credentials are encrypted at rest and used only when a run is picked up for that target.
</Note>

## Start a Run

From the target list, start a new run for the target you want to test. You can use the target's default scan mode or override it for a single run.

* **Balanced** runs a faster assessment using the standard pentest agents.
* **Deep** runs a more thorough assessment and uses additional red-team coverage.
* **Instruction override** replaces the target's additional instructions for that run only.

Pentest usage is controlled by your company's plan. If a scan mode is unavailable or out of quota, Corgea disables that option or shows an error when you try to start the run.

## Review Results

The run detail page shows progress while agents are working and lists findings as they are reported. Findings are grouped by CWE and endpoint, with severity counts across all findings and focused categories such as Auth & AuthZ, Business Logic, and Injection.

Open a finding to review its description, proof of concept, technical analysis, remediation guidance, target, endpoint, agent source, and detection history. You can update the finding status, add comments, and track re-detections across later pentest runs.

## Export Reports

When a run completes, use **Export report** to download a PDF report.

* **Technical report** includes detailed finding evidence and remediation information.
* **Executive report** summarizes the assessment for less technical audiences.

Company admins can also receive an **AI Pentest Completed** email notification with a summary and severity breakdown when a pentest finishes.

## Revalidate Findings

After a run completes, use **Revalidate Findings** to re-test open or fixed findings from that run. Revalidation checks whether previously reported findings still reproduce, closes findings that no longer reproduce, and keeps the source run's findings available from the validation run page.