AI-POWERED PENTEST REPORTS

Stop wasting
billable hours on
writing reports.

Turn raw security findings into polished, client-ready reports in minutes — not hours. AI-assisted writing, built-in CVSS 3.1 scoring, reusable findings library, and a secure client delivery portal.

Request early access See how it works →

Currently in early access — built in public, no hype

AI-generated ✦

Q3 2025 — Acme Corp Web App

Client: Acme Corp · Aug 2025 · Web Application

3C7H12M5L

SQL Injection — /api/login

Unsanitized `username` parameter allows full DB dump

9.8

Broken Object Level Auth

IDOR in /api/users/:id exposes all customer PII

8.1

Stored XSS — Comment Field

Unsanitized input in feedback form

6.4

Report delivered to client portal

FEATURES

Everything a pentester needs.
Nothing they don't.

Built by security professionals who got tired of spending Friday nights writing reports instead of doing actual security work.

AI Writing Assistant

Stream full technical write-ups for findings, business impact, and remediation steps. Accept, regenerate, or edit — always in your control.

Built-in CVSS 3.1 Calculator

Interactive CVSS scoring inline in the editor. Vector string auto-populates. Push scores directly to findings with one click.

Secure Client Portal

Password-protected delivery portal. No more emailing sensitive PDFs. Clients track remediation status directly — no extra tools needed.

Findings Library

Every finding you write gets saved to a searchable library. Reuse across engagements, tag by OWASP category, never write the same thing twice.

PDF & DOCX Export

Server-side rendered PDF with full CSS control. Programmatic Word export. Evidence screenshots embedded automatically. Client-ready in seconds.

Evidence & Screenshots

Upload screenshots directly into findings. Auto-embedded in PDF and DOCX exports. Signed URLs keep evidence secure and only accessible to you.

BEFORE / AFTER

What reporting used to look like.

✕ BEFORE PENTREPORT

✕Copy-pasting findings from Burp Suite into Word

✕Rewriting the same SQLi description for the 40th time

✕Manual CVSS scoring with a browser tab open

✕Emailing sensitive PDF over unencrypted email

✕Client asks for DOCX, you only exported PDF

✕No way to track if client actually fixed anything

6–10 hrs

per report, every engagement

✓ WITH PENTREPORT

✓3-panel editor purpose-built for pentest reports

✓AI generates full write-ups from bullet points

✓CVSS 3.1 calculator inline — score pushes to finding

✓Encrypted client portal replaces email attachments

✓One-click PDF and DOCX export, always in sync

✓Clients mark findings Fixed directly in the portal

45 min

average with AI assistance

EARLY ACCESS

Be one of our first users.

PentReport is in active development. We're looking for pentesters who want to shape the product — early access users get direct input on what gets built next.

🛠️

Shape the product

Direct access to the founding team. Your workflow problems become our roadmap. We build what you actually need.

🎁

Free during beta

Early access is completely free. No credit card, no trial period. Use it on real engagements and tell us what's broken.

🔒

Locked-in pricing

Beta users get grandfathered pricing when billing launches. The earlier you join, the lower your rate — permanently.

PRICING

Simple, transparent pricing.

No per-report fees. No surprise usage bills. Billing launches soon — early access is free in the meantime.

Billing is not yet active. All plans are shown for transparency — early access users get grandfathered pricing when it launches.

Solo

$49/mo

For freelance pentesters and bug bounty hunters

✓10 reports / month
✓AI write-up generation (100/mo)
✓CVSS 3.1 calculator
✓PDF + DOCX export
✓Client portal
✓Findings library
—
—
—

Built for the most security-conscious users on the planet.

Your reports contain your clients' most sensitive vulnerabilities. We treat that data accordingly.

🔒

Encrypted in transit & at rest

TLS 1.3 in transit. AES-256 encryption at rest via Supabase. Your data is never sent unprotected.

🚫

Zero AI training policy

We never use your reports, findings, or client data to train AI models. Ever. This is contractual.

🗑️

Full data deletion

Delete your account and all your data — reports, findings, evidence — is permanently wiped within 24 hours.

📋

Transparent sub-processors

We list every sub-processor: Supabase, Anthropic, Clerk, Vercel, Stripe, Resend. No hidden data sharing.

JOIN THE WAITLIST

Ready to stop writing reports at midnight?

We're inviting pentesters who write 2+ reports a month and want a better workflow. No waitlist games — just a real tool being built in public.

No spam. No marketing BS. Just an invite when your spot is ready.

Stop wastingbillable hours onwriting reports.