> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/readme.md).

# Overview

Pentest Copilot Enterprise documentation.

Pentest Copilot Enterprise finds, validates, and explains security weaknesses in your web applications, internal networks, cloud accounts, and source code. You define what is in scope. Pentest Copilot maps it, tests it, and reports the findings it could prove, with the evidence and attack path behind each one.

## Two Phases: Discovery and Assessment

|                   | Discovery                                                                    | Assessment                                                        |
| ----------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| **Answers**       | What do we have?                                                             | What can an attacker do with it?                                  |
| **Does**          | Maps domains, pages, APIs, hosts, services, identities, and cloud resources. | Actively tests what Discovery found and validates each finding.   |
| **Sends attacks** | No                                                                           | Yes, limited to the attack vectors or exploit families you allow. |
| **Produces**      | An inventory in the Exploit Graph                                            | Validated findings and attack paths                               |
| **Needs**         | An approved target                                                           | A completed Discovery for that target                             |

When you start a run, you pick an **intent**: **Discovery**, **Assessment**, or **Discovery + Assessment**. For a web application, keep the default, **Discovery + Assessment**: one run maps the application and then tests it. Read [How Pentest Copilot Works](/enterprise/how-pentest-copilot-works.md) for a five-minute tour of the concepts.

## Assessment Types

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Web Assessment</strong></td><td>Internet-facing web applications and APIs, logged out and per user role.</td><td><a href="/enterprise/how-to-trigger-a-web-assessment.md">Web Assessment</a></td></tr><tr><td><strong>Network Assessment</strong></td><td>Hosts, services, and Active Directory, tested from an agent inside your network.</td><td><a href="/enterprise/how-to-trigger-a-network-assessment.md">Network Assessment</a></td></tr><tr><td><strong>Cloud Assessment</strong></td><td>AWS, Azure, and Google Cloud accounts, through an agent's attached identity.</td><td><a href="/enterprise/how-to-trigger-a-cloud-assessment.md">Cloud Assessment</a></td></tr><tr><td><strong>Code Assessment</strong></td><td>Source code, dependencies, secrets, and business logic in GitHub repositories.</td><td><a href="/enterprise/how-to-trigger-a-code-assessment.md">Code Assessment</a></td></tr></tbody></table>

| Assessment  | What it covers                                               | What you provide                                                                    | Phases                                           |
| ----------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------ |
| **Web**     | Domains, pages, APIs, authenticated flows                    | Approved domains, browser sessions per role, rate limits, attack vectors            | Discovery and Assessment                         |
| **Network** | Hosts, services, identities, trust relationships             | A connected agent, subnets, exploit families, safeguards                            | Discovery and Assessment                         |
| **Cloud**   | AWS, Azure, and Google Cloud inventory and active validation | An agent on a cloud VM with an attached identity, test categories, rollback choices | Discovery and Assessment (in Network Assessment) |
| **Code**    | Source-code risks, dependencies, secrets, SBOM, and AI-BOM   | GitHub App access, repositories, and branch, PR, or commit targets                  | One run per repository target                    |

## Start Here

1. [How Pentest Copilot Works](/enterprise/how-pentest-copilot-works.md): the phases and key terms.
2. [Before Your First Run](/enterprise/enterprise-onboarding-checklist.md): access, scope, and approvals to sort out first.
3. [Run Assessment Wizard](/enterprise/run-assessment-wizard.md): the five steps every Web and Network run uses.
4. [Your First Web Run](/enterprise/how-to-trigger-a-web-assessment.md#your-first-web-run): one **Discovery + Assessment** run on one domain.
5. [Analysing Scan Results](/enterprise/analysing-scan-results.md): triage findings and build reports.

## Main Navigation

| Area          | Use it for                                                                                            |
| ------------- | ----------------------------------------------------------------------------------------------------- |
| **Dashboard** | Deployment readiness, mission status, agents, target entities, and the Exploit Graph.                 |
| **Modules**   | Run assessments and review Statistics, Attack Paths, and code inventories.                            |
| **Activity**  | Monitor runs, inspect logs, cancel work, and manage schedules.                                        |
| **Reports**   | Generate executive and comprehensive reports.                                                         |
| **Settings**  | Manage scope, verification, trajectories, agents, integrations, API keys, users, and tenant defaults. |

{% hint style="warning" %}
Pentest Copilot applies the same launch policy to UI, API, and MCP requests. Permissions, feature access, usage limits, scope controls, verification, and worker availability cannot be bypassed by changing the launch method.
{% endhint %}

See [Scan Noise and Safety](/enterprise/scan-noise-and-safety.md) before testing production or stateful environments.

For onboarding or engagement-specific questions, contact `queries@bugbase.ai`.