Highlights
Company: Thoropass
Team: In-house pentest team
Scale: Grew from a few pentesters to nearly 20
Volume: Delivered 1000+ pentest assessments
Core Workflow: Live reporting during testing + reuse of a findings library
Cyver Core Value: Fast, consistent report generation, easy onboarding, enterprise-ready integrations
Typical reporting time (post-testing): ~1–2 hours to generate the final report
Background
Around September 2023, Thoropass made the strategic decision to build an in-house pentest team
Since then, the team has scaled quickly: from a small group of pentesters to nearly 20, delivering close to 1000+ assessments—with reports generated through Cyver Core.
A key takeaway from Thoropass’ growth story: as the team scaled, the reporting experience remained consistent and intuitive, without increasing complexity.
The Challenge
When Thoropass launched the in-house pentest practice, the main challenge wasn’t switching from a previous tool—it was the urgency of starting fast with a solution that could support growth.
They needed a reporting platform that would:
- Help them stand up the pentest business quickly
- Support repeatable, high-quality reporting at volume
- Make onboarding new pentesters easy and consistent
- Handle enterprise requirements when needed (portal + API integrations)
Thoropass evaluated multiple vendors and selected Cyver Core as the most complete and well-rounded option.
Why Cyver Core
Thoropass chose Cyver Core after a vendor assessment comparing multiple solutions. They’ve renewed yearly—even with competitors in the market—because the product remained reliable, complete, and supportive of their operating model.
“Even though there are several competitors in the market… the product is pretty well-rounded and complete.”
How Thoropass Uses Cyver Core
Thoropass uses Cyver Core primarily as an internal reporting engine and as a repository of findings, with selective portal access for enterprise customers.
1) Tokens for highly customized reports
One of the most valuable capabilities for Thoropass is the flexibility of tokens/variables, enabling report customization at scale—especially when customers have specific compliance-driven formatting or content requirements.
“When a customer has a special need on their report… we can create specific sections using variables/tokens… and they’re really pleased with the outcome.”
2) A reusable library of findings
Their pentesters rely on a library of pre-built findings to avoid rewriting repetitive content. This accelerates reporting while keeping quality and consistency high.
“We already have a library of findings… they can import the finding and change a little bit of the context.”
3) Portal + APIs for enterprise workflows (when required)
Most customers simply need the PDF for compliance (“tick the box”), so Thoropass doesn’t automatically provide portal access. But when enterprise customers request it, Cyver Core supports access and integrations—like pushing issues into Jira or pulling findings into a vulnerability management system.
“For enterprise customers… they require access to the platform and APIs… integrate into Jira… pull issues into their own tracking system… and it has been working flawlessly.”
Live Reporting + Fast Finalization
Thoropass runs a “live reporting” approach: as soon as pentesters identify an issue, they log it in Cyver Core during the testing phase. That means the report is essentially built as the engagement happens.
Once testing is complete, generating the final deliverable is fast.
Result: excluding testing time, Thoropass estimates pentesters spend ~1–2 hours to produce the final report.
Scaling Without Friction: Onboarding New Pentesters
Because Thoropass continuously hires and onboards new pentesters, usability matters. They highlighted how intuitive Cyver Core is for new joiners and how internal expertise (e.g., their team member Fabricio, who knows Cyver Core “top to bottom”) helps keep onboarding smooth and consistent.
Partnership & Support Experience
Thoropass also called out the Cyver team’s responsiveness: when they report bugs or request improvements, they often see fixes or solutions within a few days. They appreciate ongoing communication about releases, plus webinars that keep them informed about what’s coming next.
Conclusion
Thoropass built and scaled a modern in-house pentest practice fast—growing to nearly 20 pentesters and delivering close to 1000+ assessments—while keeping reporting consistent and efficient.
By combining live reporting, a reusable findings library, tokens for customization, and enterprise-ready integrations, Cyver Core helped Thoropass scale volume without sacrificing the customer experience.
Challenges Before Cyver Core
- Reporting drag: Writing reports was the most time-consuming, least enjoyable part for testers, often saved until the end of an engagement.
- Slow client updates: Critical issues needed to be communicated quickly, but that meant spinning up ad-hoc Word docs and emails—easy to miss and hard to track.
- Fragmented collaboration: Credentials, documents, and retests were scattered across tools and email threads.
“Making reports is the most boring part of our work. If you can make that easier, testers spend more time digging deeper into the app or network.”
Why Cyver Core
NullForge evaluated several platforms and chose Cyver Core because it was fast to implement and opinionated in the right places—making it easier to adapt the business to the product rather than customizing endlessly.
Key factors:
- Simplicity & speed: Less overhead and configuration than alternatives.
- Live reporting: Create findings during testing, attach evidence immediately, and push to QA in the flow.
- Client portal: One place to share credentials, upload docs, message securely, and request retests (full scope or finding-specific).
- Growing flexibility: Over time, the product introduced more customization (e.g., finding templates), increasing power without losing overall ease of use.
“You start your test, find a vulnerability, create the finding, add evidence, push to QA—that’s done. At the end, it’s mostly the management summary and generate the PDF.”
Implementation
- Live reporting as policy: Testers log findings as they go, including evidence, then push them to QA—shifting the “report day” into the daily workflow.
- Portal-first collaboration: Clients log in to provide credentials, follow progress, and coordinate retests.
- Hybrid client usage: Some clients use the portal deeply (requests, messaging, remediation status), others simply log in to download the PDF—NullForge supports both.
- Data hygiene: To match internal policy, NullForge deletes projects after completion (they do fewer continuous tests), keeping the portal lean and aligned to their processes.
Results
- ~50% faster reporting (especially for network tests) thanks to live, incremental finding creation.
- Earlier remediation: Clients see critical issues during the engagement, not just at the end—shortening exposure.
- Cleaner comms: Credentials, docs, messages, and retests happen in one audited place.
- Scale without chaos: With hundreds of pentests per year, the team maintains pace and quality, and clients return regularly.
“We have a lot of customers that return for short pentests throughout the year. The reporting tool helps—we even use it as a selling point.”
Feedback & Feature Evolution
NullForge appreciates that Cyver Core continues to evolve—client templates and event logs/audit logs are on the roadmap they care about. They note notifications can get noisy when many projects run in parallel (e.g., same email type for publication and retest requests), and they flagged a sorting quirk past 999 items. Still, they rate Cyver Core 7–8/10 today—“one of the better solutions” they tested—and a platform they couldn’t easily replace without reworking operations.
“We’ve onboarded new pentesters directly into Cyver Core. Templates and workflows are there—they don’t need to copy/paste boilerplate anymore.”
Conclusion
By adopting Cyver Core, NullForge Security turned reporting from an end-of-week slog into an in-flow activity, enabling live client updates, smoother retests, and faster delivery overall. The result: more time testing, less time formatting, and a scalable PTaaS model that supports both light-touch and highly interactive clients.
Key takeaway: Cyver Core helps NullForge move faster, communicate clearer, and scale sanely—without drowning in admin.
