Every stage of a pentest, in one workspace.
From the first enquiry to the retest, PenVanta keeps the whole engagement in one place, with each person seeing exactly what their role needs.
Product screenshot · sample data
Win the work, then scope it properly.
A seven-stage pipeline takes every enquiry from first contact to won or lost. Converting a won record creates the project with every agreed target already in scope.
- Targets and exclusions: domains, IPs, CIDR ranges, URLs, APIs, apps and cloud resources
- Paste targets in bulk or import from CSV
- Time-zone-aware testing windows, conditions and emergency contacts
- Scope is hidden from schedulers and clients
Know where every engagement stands.
Each project carries its client, contacts, team, dates and a live delivery timeline that clients can follow without emailing you.
- Your own reference prefix, such as ACME-0042
- Assignments for testers, QA and schedulers
- A live timeline of phases, with a client-safe history
- Role-aware home pages: risk for admins, work for testers
Drop in tool output. Get structured data.
Upload exports from the tools you already run. PenVanta recognises the format, parses it in an isolated worker and builds the asset inventory.
- Nmap, Nessus, Burp Suite, Nuclei, testssl.sh, BloodHound, PingCastle, Prowler, Semgrep, WPScan and Masscan
- Resumable uploads of up to 250 MB, verified in parts
- One asset per host, merged across tools
- Out-of-scope hosts flagged, re-imports deduplicated
Your finding library, applied automatically.
Every finding comes from your organisation’s own write-up. Tool signatures map scanner results to it, so the same issue reads the same way in every report.
- Map a result once and every future import maps itself
- Import an existing library from JSON, CSV or Excel
- Per-asset evidence, verification and redaction
- Optional AI draft, off by default, with an exact preview of what’s sent
A network map drawn from your evidence.
PenVanta derives a topology from the assets, services, scope and findings you imported. It states what’s on the network, and says so honestly: attack paths are deliberately left out.
- Every statement labelled observed, inferred or manual
- Deterministic, with no language model
- Your edits and layout are never overwritten
One template. PDF and editable Word.
Design your report visually with a live preview, or import the Word template you already use. Output is a deterministic PDF and a native .docx.
- Cover, page layout, headers, typography, tables and finding presentation
- Safe variables and conditional sections
- Word template import with a mapping review
- Frozen template versions, so issued reports never change
Approval tied to the exact version.
Assign reviewers, comment on quoted text, request changes. Approval is bound to an immutable version and its checksum, so a later edit can’t slip through.
- A QA board across every project
- Publication checks QA, comments, placeholders and images
- Releases recorded with SHA-256 hashes; withdrawals audited
A portal that becomes a remediation workspace.
Clients sign in without a password and see only what you published. They respond to each affected asset, request retests and download released files.
- Responses per asset: fixed, risk accepted, ready for retest, false positive
- Retest requests with up to three preferred weeks
- Separate internal and client conversations on every project
- Linked assessments answer: have high-risk issues come back?
Secrets out of chat. Passwords out of storage.
A credentials vault built for testing engagements, and a password audit that produces clear analytics without ever keeping a password.
- Vault reveal needs a fresh sign-in, is audited first and auto-masks after 30 s
- Password audit: 11 analytics views, and it never stores a password or hash
- Reuse across privileged and standard accounts, detected via keyed fingerprints
Permissions that mean something.
Custom roles, QA as an extra capability, a scheduler who never sees files or credentials, and clients who can never be given internal access.
- Invite people; there is no public sign-up
- Changes apply to live sessions on the next request
- Your branding, colours, severity palette and project prefix
See your own engagement in PenVanta.
Bring a sanitised report or a recent scan. We’ll walk through how the same test runs in PenVanta, from import to the portal your client sees.
- PenVanta Dedicated or self-hosted, even air-gapped
- PDF and native, editable Word from one template
- No passwords to steal, anywhere in the product