The Operating System for Pentest Teams

Plan, coordinate, and execute pentest engagements with structured workflows, team visibility, and operational consistency.

Scoping and engagement setup

• Quotes and Statements of Work - Prepare quotes and SoWs, and send them to clients for approval and signature.
• Custom request forms - Collect assessment requests, scoping information, and client requirements.
• Scope and asset management - Maintain target assets and engagement details, with Excel import and export.
• Reusable project templates - Standardize engagement setup with predefined workflows, checklists, and custom fields.

Workflow and resource planning

• Configurable project workflows - Define engagement stages and statuses to match your delivery process.
• Task ownership and deadlines - Assign responsibilities and due dates across testing, review, and delivery.
• Scheduling and resource planning - Coordinate pentester availability and parallel engagements through calendar and Gantt views.
• Timesheets - Record time spent on engagement work.

Team coordination and access 

• Pentester teams - Organize testers into teams to support engagement delivery.

• Roles and permissions - Configure access for managers, pentesters, and viewers.

• Internal workflow tasks - Keep operational tasks separate from client-facing activity.

• Internal notes and messages - Keep team discussions and operational context connected to the engagement.

Transform findings, testing activity, and tool output into structured security intelligence that supports analysis, reporting, and remediation.

Methodologies and assessment coverage

• Standard and custom testing checklists - Use built-in methodologies such as OWASP OTG and ASVS, or create custom checklists for your assessment procedures.

• Multiple methodologies and asset coverage - Combine checklists within one engagement, link testing tasks to assets, and export them for review.

• Technical benchmarks - Assess security configurations against included CIS Benchmarks and other technical baselines.

• Compliance standards and security frameworks - Map findings and assessment coverage to included standards and frameworks such as OWASP Top 10 and PCI DSS.

Findings and evidence

• Tool imports and data exchange - Import findings and scan results from Burp Suite, Nessus, Nmap, Qualys, and other supported tools, with XML, CSV, and Excel support for data exchange.

• Finding libraries and enrichment - Reuse vulnerability write-ups and populate references from CVE, CWE, and Exploit-DB.

• Evidence and custom fields - Organize supporting evidence and adapt finding documentation to your methodology.

• Finding consolidation and relationships - Merge or clone entries, connect related issues, and organize parent and sub-findings.

Attack analysis and continuous validation

• Scenarios and ATT&CK mapping - Define attack objectives and associate steps with relevant tactics and techniques.
• Attack chains and mitigations - Visualize attack progression, record timestamps, and document where defenses could interrupt the chain.
• Continuous projects and recurrences - Organize ongoing testing runs and track findings that reappear.
• Finding and project retests - Coordinate follow-up testing and record whether remediation addresses the reported issues.

Turn technical findings into professional client delivery with streamlined reporting, collaboration workflows, and continuous remediation tracking.

Report authoring and automation

• Markdown and rich-text editors - Write technical findings, methodology sections, and executive summaries.

• Flexible report templates - Use master templates, optional sections, and multiple report templates per engagement.

• Dynamic tokens and reusable content - Populate reports with project data, finding details, attack-chain diagrams, and common text blocks.

• Branded, multilingual deliverables - Customize report styling and navigation, with PDF generation and Word or HTML export.

QA Review and AI assistance

• Real-time collaborative editing - Work on the same report with teammates during preparation and review.
• Quality review and versioning - Manage report comments and revisions, with review workflows for findings and libraries.
• Contextual AI copilot - Draft findings and executive summaries, then refine content through custom editing prompts.
• MCP-connected assistants - Connect compatible AI tools such as ChatGPT and Claude to retrieve project context, inspect evidence, and update permitted data.

Client delivery and remediation

• Branded client portal - Share reports, findings, and files with configurable client access.

• Client communication and retests - Coordinate updates, remediation discussions, and retest requests through the portal.

• Remediation SLAs and ticketing - Track remediation timelines and connect findings with Jira, Azure DevOps, and other supported systems.

• Dashboards and finding exports - Share risk summaries, remediation trends, time-to-fix insights, and finding data in Excel.