AI Pentest Report Writing AI on Your Key, Your Hardware, and Your Terms.

Three Routes. Every One of Them Is Yours.

Your Key Is Never Kept by Pental.

An AI key is a credential to your provider account and your spend. Here is its entire life, start to finish.

1. 01You paste the key into your own portal, on your own domain.
2. 02It is encrypted on write, inside your own database, using a key generated in that same database. The encryption key never leaves your project and is not known to us.
3. 03The plaintext column is nulled. What is at rest is ciphertext only.
4. 04When a generation runs, your portal hands the request to your own database, and the database decrypts the key and adds it as the request leaves for your provider: on Supabase it sends the request itself, and behind a Pental gateway the gateway does. The answer comes back the same way, to the person who asked, once.
5. 05Neither the key nor the finding it is used on passes through Pental. Where your database cannot send yet, Pental's relay asks it for the key with a request signed for that one call and keeps neither, as it still does for the features that run on Pental's servers rather than in your portal. For a route that leaves your network for no provider at all, use Ollama: your browser talks to your own model.

Local Models Are a First-Class Citizen, Not a Checkbox.

The local route is not a degraded mode. In one important way it is the better one: with no per-token bill and no provider rate limits to design around, the platform can afford slower, more careful passes over your engagement when drafting, which shows in the output.

• Nothing leavesPrompts, evidence and drafts travel between your portal and your Ollama instance inside your network. There is no third party in the diagram to put in a data-processing agreement.
• Your model choiceRun whichever model your hardware carries and your quality bar accepts, and change it whenever the state of the art moves. GPU hardware you already operate for password auditing runs these models comfortably.
• No meteringGeneration costs you electricity, not tokens. Regenerate freely, run longer passes, and never think about a usage bill again.
• Same platformEverything the AI does on the hosted routes it does locally: findings, summaries, custom sections, all of it.

From Evidence to a Finished Finding, in One Action.

Paste your rough notes as you captured them, screenshots, code, requests, output and tables alike, and one button turns them into a finished finding. It explains each piece first, with a caption under every screenshot, rewrites the words you typed as report prose without changing a value in them, leaving out the to-dos and side issues that belong elsewhere, names the finding and brings in your library's own wording where you have written the weakness up before, then drafts the rest: the description and remediation, the CVSS vector, the CWE and category, the affected assets, your own custom fields and the references, in that order, each step using what the ones before it produced. Anything you have already written is left alone.

Every Prompt Is Yours to Rewrite.

Each generated field has its own prompt, visible and editable in settings. House style, structure rules, banned phrases, the level of detail your clients expect: put it in the prompt once and every draft follows it. A reset returns any prompt to the shipped default, so experimenting is safe.

Your Report Template, Understood Once.

Upload the Word report you already send. The platform reads its structure and maps your placeholders, tables and sections to live engagement data. From then on, rendering is deterministic: the same engagement produces the same document, byte for byte, with no AI in the loop at render time.

1. 01Upload the DOCX you send clients today, cover page, styles, appendices and all.
2. 02Review the mapping: which placeholder receives which field, which table receives the findings, which section repeats per finding.
3. 03Generate forever. Rendering is mechanical from here, so what varies between two reports is the engagement, never the machinery.

The Off Switch Is a Real Off Switch.

Configure no provider and the AI is simply absent: no buttons, no nags, no degraded mode. Engagements, findings, QA, reports, retests and the client portal all work completely without it, because the platform was built to run a firm first and to draft prose second. Turn it on later, or never, and change routes whenever you like.

Questions About the AI.