AttackForge adds capability plan by plan: QA from Team, your own domain from SME, two-way ticketing as an upgrade on Core, and its AI connection an add-on below SME. Pental includes every feature for one tester or a hundred, keeps each firm’s data in its own Postgres database, and drafts the finding itself with AI on your own key. Here is the comparison, from each one’s own published information.
Each of AttackForge's answers is taken from its own website or documentation, and each of Pental's from the screens it describes. Where AttackForge's documentation does not cover something, the line says so rather than guessing.
| Compared | Pental | AttackForge |
|---|---|---|
| Built for | Penetration testing firms of every size, with every feature at any size: the Portal priced per tester, the rate falling as a team grows, and our free, open-source reporting tool for a firm that wants only the reporting. | Consultancies and security practices (Core) and internal offensive security programmes (Enterprise), from one tester upwards. |
| Hosting and data | The Portal: Pental runs the software and your firm holds the data, in its own Postgres database: in your own cloud, on a server of yours or on Supabase Cloud, where Pental cannot read your findings. The free reporting tool runs on your own server, beside its own PostgreSQL. | A dedicated single-tenant instance on Azure in the region you choose, with data on Azure and MongoDB Atlas. Enterprise can also run on your own Linux server, air-gapped if need be. |
| Client portal | A standing account for each client with every report, finding, retest outcome and attestation letter. Findings arrive when you release them, and questions are raised on the finding. | Client users in the platform, unlimited on Core and Enterprise, who request testing, view findings and reports and record remediation. |
| Your brand | Your own domain with TLS issued automatically, your sign-in page, email from your own address, and no Pental branding anywhere. | Your logo, your sign-in screen and your emails. Your own domain on the SME plan and Enterprise; *.attackforge.io on the smaller plans. |
| Report templates | Your own Word template, with your cover page, headers, fonts, tables and appendices, or the built-in PDF. The same engagement renders the same file every time. | Reports generated from customisable DOCX templates, with data also exported as JSON and CSV. |
| Editing the report in Word | Upload the edited report and the assessment updates to match, item by item, only where you tick. A reviewer’s tracked changes arrive as suggested edits. | Its reporting documentation does not describe reading an edited report back. |
| AI | Your own key with OpenAI, Anthropic or Groq, or a model on your own hardware through Ollama or any compatible endpoint. Every prompt can be read and rewritten. | Your own AI assistants, such as Claude, ChatGPT or Copilot, or local models, connected through MCP: included on Enterprise and the SME plan, an add-on on the smaller plans. |
| QA review | Draft, in review and approved, with suggested edits made on the field itself, the firm’s own QA checklist ticked before a report can be approved, an AI reviewer if the firm turns it on, and release waiting for approval. | Review notes and a configurable QA status, from the Team plan upwards. |
| Retests | Clients ask from the finding they are reading, or by closing a ticket in their own tracker. Every finding is tracked as fixed, still open or newly introduced. | Retesting rounds, requested and optionally approved, with each vulnerability’s history from open, through retesting, to closed. |
| CVSS | CVSS 3.1 or 4.0, with the vector derived as you choose the metrics. | CVSS 3.1 and 4.0, with DREAD, the OWASP Risk Rating Methodology and a custom 4x4 matrix also included. |
| Findings library | Write-ups saved once and reused with their scoring and remediation intact. | Over 1,500 write-ups supplied, drawn from MITRE CWE and CAPEC. |
| Issue trackers | Clients connect their own Jira (Cloud or Data Center), ServiceNow, Azure DevOps, GitHub, GitLab or Linear, and the ticket’s state is read back; any other system can take findings by webhook. | Jira, ServiceNow and Azure DevOps, with two-way sync: an in-app upgrade on Core. |
| Importing tool output | Sixteen formats imported as findings, including Nessus, Burp Suite, OpenVAS, Qualys, Nmap, ZAP, Nuclei and SARIF. | Imports from tools including Burp Suite, Nessus and Qualys, and CSV and JSON for anything else. |
| Pricing | Published: the Portal is £75 a tester a month for one ($99), falling with every tester added, with every feature included. Our reporting tool, the reporting on its own, is free and open source under the AGPL-3.0. | Published: from $50 a month (Pro, one tester) to $800 (SME, twenty testers), and Enterprise by quote. |
| Trying it | A free trial of the Portal with no card required, whose days start when your portal goes live. The reporting tool is free to download and run. | A free trial of Core with no card required, lasting 24 hours, which can be started again up to five times. Trial data does not move to a paid account. |
Facts about AttackForge come from AttackForge’s own website, its pricing, integrations and AI pages, its support documentation and release notes, and its trial page, read on 28 October 2026. Products change: if anything here is out of date, tell us and we will correct it. Product names are the trademarks of their owners, and Pental is not affiliated with any of them.
AttackForge’s plans add capability as they go up: QA workflows start on Team, the MCP connection for AI is included on SME and Enterprise, two-way ticketing is an in-app upgrade on Core, and your own domain comes with SME and Enterprise. Pental’s price changes with your testers alone: QA review, the client portal, your own domain, AI and issue trackers come with one tester or a hundred.
On AttackForge’s smaller plans your clients sign in at *.attackforge.io; your own domain comes with SME and Enterprise. Every Pental firm has its portal at its own address, such as portal.yourfirm.com, with TLS issued and renewed automatically, from its first tester.
AttackForge connects your own AI assistants, such as Claude, ChatGPT or Copilot, or local models, to the platform through MCP. Pental drafts inside the finding itself: one action writes the title, description, remediation, CVSS, CWE and references from your evidence, on your own OpenAI, Anthropic or Groq key or a local model.
AttackForge’s trial of Core lasts 24 hours, can be started again up to five times, and its data does not move to a paid account. Pental’s free trial needs no card, its days start only when your portal goes live, and it is your real portal on your own database from the start.
AttackForge’s project JSON, a project table exported to CSV, or its Self-Service API’s JSON goes in Coming from another platform, under Settings, Data. Pental reads it, shows you the mapping with real values from your own data beside each field, and lets you correct it before a single row is written. Your clients, engagements and findings come across.
Pental fits a testing firm that wants its clients' findings in a database of its own, reports in its own Word template, a client portal under its own name and AI on its own key, with every feature included. See the pricing, or see the platform. For the reporting on its own, our free, open-source reporting tool runs on your own server.
Where the data lives and what each plan includes. AttackForge runs each customer on a dedicated instance on Azure, with Enterprise able to self-host, and adds capability plan by plan. Pental runs the software and keeps each firm’s data in the firm’s own Postgres database, and every feature is included at any size. Both publish their prices.
AttackForge lists plans from $50 a month for one tester to $800 a month for twenty, with Enterprise by quote. Pental’s Portal is $99 a tester a month for one (£75), falling as testers are added, and twenty testers are $1,106.20 a month, with every feature included, so compare them at your own team size and with what each one includes.
AttackForge’s trial of its Core product lasts 24 hours, and a new one can be started up to five times. Pental’s free trial needs no card, and its days start when your portal goes live, so setting up uses none of them.
Yes, at any size: portal.yourfirm.com, with TLS issued and renewed automatically, your own sign-in page and email from your own address.
AttackForge’s project JSON, a project table exported to CSV, or its Self-Service API’s JSON goes in Coming from another platform, under Settings, Data. Pental reads it, shows you the mapping with real values from your own data beside each field, and lets you correct it before a single row is written. Your clients, engagements and findings come across.
Set up your own database, upload your own Word template and take a real engagement through it, client portal and all. A free trial of the whole Portal, no card required, and its days start when your portal goes live.