> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart: start continuous pentesting

> Connect an account, authorize a domain, start your first pentest, fix and retest a finding, then set a testing schedule.

This guide takes you from a new Tolmo organization to continuous pentesting. You must have an invitation first. See [Request access](https://docs.tolmo.com/request-access.md).

Before you start, prepare these items:

* Access to a cloud account (AWS, Google Cloud, Azure, or Cloudflare) or a code host (GitHub or GitLab). You must be able to connect it.
* At least one domain you are authorized to test.
* *(Recommended)* A dedicated test login for your application.

**1. Connect your first account**

Connect a cloud account or a code host. The first scan starts immediately. Results usually arrive within one hour.

During the scan, Tolmo builds your [knowledge graph](https://docs.tolmo.com/knowledge-graph/overview.md). Tolmo also finds your domains, hosts, and applications. For all supported providers, see the [integrations catalog](https://docs.tolmo.com/integrations/catalog.md).

**2. Authorize a domain**

Enable offensive testing on a domain that you own. If you have a staging domain, start with it.

[Safety and authorization](https://docs.tolmo.com/safety.md) explains the scope that you authorize.

**3. Add a test account (recommended)**

Give the agents a test login. Also give them the notes that they need to reach your app.

Without a login, the agents test only the pages that an anonymous visitor can reach. See [Define scope](https://docs.tolmo.com/pentesting/scope.md).

**4. Start your first pentest**

Start a Red team run. The run tests all authorized domains. It reports only the issues that it can exploit.

**5. Review a validated finding**

Open a finding. The finding shows what happened and why it is important. It also shows the request that exploited the issue.

See [Understand a finding](https://docs.tolmo.com/pentesting/findings.md).

**6. Fix and retest**

Give the fix prompt to your coding agent. Ship the change. Then retest the finding. When the attack fails, Tolmo resolves the finding.

See [Fix a finding](https://docs.tolmo.com/pentesting/fix.md) and [Retest a fix](https://docs.tolmo.com/pentesting/retest.md).

**7. Make it continuous**

Set a daily or weekly schedule for the Red team agent. Let the Blue team agent validate new findings from your security tools when they arrive.

Send notifications to Slack or email. Then you get new findings without opening Tolmo. See [Keep up with production changes](https://docs.tolmo.com/pentesting/production-changes.md) and [Notifications](https://docs.tolmo.com/agents/notifications.md).

## Next steps

> [card] [How the Red team agent tests](https://docs.tolmo.com/pentesting/red-team-agent.md)
>
> The steps of a run, from recon to the verified report.

> [card] [Validate the findings you already have](https://docs.tolmo.com/pentesting/third-party-findings.md)
>
> Let the Blue team agent prove or disprove your scanner alerts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.