> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/configure-a-pentest/safety-measures.md).

# Safety Measures

To minimise the impact the pentest can have on your environment, the following safety mechanisms are in place.

{% hint style="success" %}
We strongly recommend to launch the pentest in staging, test or isolated environments
{% endhint %}

## Preventing pentests outside of intended scope

By design, the pentesting agents cannot reach domains that have not been explicitly approved during the setup of the pentest. Two security boundaries are in place:

1. **Attackable domains**: Domains that can be actively attacked during the pentest
2. **Accessible domains:** Domains that should not be actively attacked but are allowed to be used.

In the example configuration below, the agents can attack the specified subdomains under `attack-me.com` and use `auth.provider.com`. All other domains are blocked.

<div data-with-frame="true"><figure><img src="/files/X53v47tOah6Qg9xuJdYH" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}
**Note:** Requests containing static files or that are part of developer tool platforms are automatically accessible, but will not be attacked.
{% endhint %}

## Pause or Cancel a Pentest

**Cancel** permanently stops the assessment, you can't resume it. Credits used on the run are not refunded unless you cancel within the first few minutes of launch. Use **Pause** instead if you want to stop attacks and continue the same assessment later.

**Pause** temporarily stops attack agents while the assessment stays open. **Resume** continues testing. Pause is only available once agents are actively attacking—not during scheduling, codebase analysis, access checks, or discovery. Each assessment can be paused manually up to 3 times.

Aikido may also pause the assessment on its own when something needs attention, for example blocked requests or login issues. Check the status on the assessment page, fix what it asks for, then click **Resume** when you're ready to continue.

## Mitigating high server load

To minimize potential impact due to server load, the setup allows the configuration of the maximum requests per second that the pentest generates and the option to execute it in our outside of business hours.

You can change this setting during the pentest as well after it was launched.

<div data-with-frame="true"><figure><img src="/files/lRHMPjIcyRAAnnEVXVqW" alt=""><figcaption></figcaption></figure></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/pentests/configure-a-pentest/safety-measures.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.