> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/readme.md).

# Overview

Pentest Copilot Enterprise helps security teams scope, run, and review external, internal, cloud, and code assessments from one control plane. It combines agent-based execution, browser automation, attack-path analysis, validated findings, scheduling, reporting, and API/MCP automation.

## Assessment Types

| Assessment   | What it covers                                                                                               | What you provide                                                                                     |
| ------------ | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |
| **External** | Internet-facing domains, pages, APIs, services, authenticated flows, and vulnerability testing.              | Approved domains, intent, authentication coverage, rate limits, and attack vectors.                  |
| **Internal** | Reachable networks, hosts, services, identities, trust relationships, and approved exploit validation.       | A connected agent, subnet scope, intent, exploit families, and safety controls.                      |
| **Cloud**    | AWS, Azure, and Google Cloud inventory and approved active validation through an attached workload identity. | A cloud-hosted agent, provider permissions, discovered scope, test categories, and rollback choices. |
| **Code**     | Source-code risks, dependencies, secrets, authorization and business logic, SBOM, and AI-BOM.                | GitHub App access, repositories, branches/PRs/commits, checks, and automation rules.                 |

## Run Assessment

External and internal work starts from **Modules -> \[assessment type] -> Run Assessment**. Choose one intent:

* **Discovery** maps the selected environment without active vulnerability testing.
* **Assessment** tests inventory that has already been discovered.
* **Discovery + Assessment** refreshes inventory and then assesses what was found.

The wizard then guides you through **Scope**, **Scan settings**, **Automation**, and **Review**. Code Assessment uses the same flow without an Intent step.

<figure><img src="/files/F7Wpo6JP1EIZ44TyISsW" alt="External Run Assessment intent step showing Discovery, Assessment, and Discovery plus Assessment"><figcaption><p>Select the outcome you need before configuring scope.</p></figcaption></figure>

## Main Navigation

| Area          | Use it for                                                                              |
| ------------- | --------------------------------------------------------------------------------------- |
| **Dashboard** | Deployment readiness, mission status, agents, target entities, and the exploit graph.   |
| **Modules**   | Configure runs and review Statistics, Attack Paths, and code inventories.               |
| **Activity**  | Monitor runs, inspect logs, cancel work, and manage schedules.                          |
| **Reports**   | Generate executive and comprehensive reports.                                           |
| **Settings**  | Manage scope, verification, agents, integrations, API keys, users, and tenant defaults. |

## Recommended First Run

1. Confirm your role has the required scan and settings permissions.
2. Add approved external domains or connect the internal/cloud agent that can reach the intended scope.
3. Verify external domain ownership when required.
4. For authenticated external testing, record and validate one browser session per user role.
5. Open the applicable **Run Assessment** page and start with **Discovery** or **Discovery + Assessment**.
6. Keep the first scope narrow and use conservative rate limits or exploit selections.
7. Confirm the complete configuration on **Review**, then choose **Start run** or **Schedule run**.
8. Monitor the run under **Activity**, triage findings under **Attack Paths**, and generate reports when the assessment is complete.

{% hint style="warning" %}
Pentest Copilot applies the same launch policy to UI, API, and MCP requests. Permissions, feature access, usage limits, scope controls, verification, and worker availability cannot be bypassed by changing the launch method.
{% endhint %}

See [Scan Noise and Safety](/enterprise/scan-noise-and-safety.md) before testing production or stateful environments.

For onboarding or engagement-specific questions, contact `queries@bugbase.ai`.