PenVanta Remediation turns the reports your testers send you, from any provider, into one record per weakness. Each gets an owner and a deadline, fixes are proved with retests, and the history is kept for years.
A pentest report lands as a PDF. Then come the spreadsheet, the chasing, the “is this fixed?” emails, and next year the same findings again. Drag the slider.
Upload the report you were sent. PenVanta proposes each finding with the page it came from, and nothing is created until someone has reviewed it.
When a later assessment reports it again, it joins the finding you already have, with every assessment that reported it.
Retests record a result for each affected asset. What passes is resolved; what fails goes back to its owner.
Five steps, one record for each weakness running through them. Nothing is retyped between spreadsheets, inboxes and people.
Upload the PDF or Word report you were sent, a CSV export or a scanner file. Page headers, summaries and appendices are left out, only host names, IP addresses and web addresses become assets, and nothing is created until you have reviewed it.
Optional: have your chosen AI provider read a report with an unusual layout. It is off unless you choose it for that import.
Set how many days each severity has to be fixed. Deadlines count from the end of the assessment, an owner is suggested from the assets a finding affects, and the Remediation page shows who has what and what is slipping.
With an AI provider chosen by your administrator, How to fix rewrites a finding for the IT or development person: what to change, commands where they help, how to check it worked, and what could break, only when something could.
AI can make mistakes. Every answer says so, and asks for the steps to be checked against your systems and tested first.
Group fixed findings into a retest, schedule it and record passed, failed or partially fixed for each affected asset. Completing it resolves what passed and sends the rest back to its owner.
See what is open by severity, by what fixing it takes (a patch, a configuration change, code or a process), by service line, team and root cause, how fast findings are fixed and what changed since the last assessment. Every slice opens the findings behind it.
Each imported finding is compared with the ones you already have: title words, CWE, affected assets and the provider’s own reference. You confirm the match, and the finding keeps every assessment that reported it.
From the people who fix findings to read-only auditors.
7roles
A business reason, a risk owner, compensating controls and an end date, approved by someone other than the person asking. When it ends, the finding opens again.
Business units and applications, each with an owner. Findings belong where their assets do, and lists and analytics can be narrowed to one.
Status, owner, deadline and severity changes with who, when and why. The history cannot be edited.
Every finding a host or application has had, assessment by assessment.
Everything done in the organisation, exportable as CSV, and one archive of all your records when you need it.
Open pentest findings are exactly what an attacker would want to read. PenVanta keeps them on infrastructure that is yours alone, behind sign-in without passwords.
Passkeys or one-time email codes for everyone. There is no password database to leak.
8-char codes · 5 min · HMAC-storedEvery PenVanta Dedicated customer gets its own server, file storage, keys and licence. Or run it on your own servers.
no shared database or storageEvidence files are checked against what was announced, checked to be what their name says, then encrypted and bound to their finding.
AES-256-GCM at restAssignment emails and daily reminders name references and give counts. Finding titles and details stay behind sign-in.
references and counts onlyTwo ways to run PenVanta Remediation, with the same features in both. Either way you know exactly where your findings and evidence are kept.
Your organisation’s own private server and file storage, run and updated by us. Nothing is shared with any other customer.
Run PenVanta on your own Linux server with Docker, in your data centre or your cloud account. All your data stays with you.
External, internal, web, cloud and mobile tests side by side, compared by service line, team and root cause.
SLAs per severity set every deadline, and the Remediation page shows who has what and what is slipping.
Time to fix, SLA compliance and what came back since the last assessment, worked out from the findings themselves.
Findings assigned to you or your team, with what is overdue and due soon at the top.
Optional AI guidance written for the person making the change, with risks spelled out when there are any.
Screenshots, change tickets and exports attached to the finding, then a retest to close it.
Approved by someone other than the person asking, with controls, an owner and an end date.
Every change to every finding, with who, when and why, and an audit trail you can export.
Export everything in one archive: records, audit trail and evidence files.
No. PenVanta Remediation reads the reports your providers already send: PDF and Word reports, CSV exports, and exports from Nessus, Burp Suite, Nuclei, testssl.sh, Prowler, Semgrep, WPScan and PingCastle. Column matches are remembered for each provider, so their next file fills itself in.
Upload the report, up to 25 MB. PenVanta reads its text, leaves out page headers and footers, summaries, methodology and appendices, and proposes each finding with its severity, affected hosts and the page it came from. You review and correct the proposals, and nothing is created until you confirm. Scanned PDFs without text cannot be read.
It is offered as the finding you already have, matched on title words, CWE, shared assets and the provider’s own reference. Confirm it and the finding gains the new assessment in its history. If it had been fixed, it is reopened, so you can see what came back.
Only if your administrator chooses a provider: OpenAI, Anthropic, or Ollama on your own network. It can then read reports with unusual layouts when someone asks for that import, and explain how to fix a finding. Each screen shows what will be sent first, and host names and IP addresses are not sent for fix guidance. AI can make mistakes, so its answers are suggestions for a person to check.
Not yet. Ticketing integrations are planned. Until then each finding has a ticket reference field, so your team can record where the work is tracked.
With PenVanta Dedicated, on your organisation’s own private server and file storage, run by us in the region you choose. If you self-host, on your own infrastructure. Either way nothing is shared with other customers.
Yes. Export everything gives you one archive of every record, the audit trail and every evidence file, and the findings register is available as CSV at any time.
We’ll import a sanitised report with you and show how its findings become owned, tracked and retested work, and what next year’s assessment will tell you.
