AI Pentest Report Writing in the Free Reporting Tool

Our free reporting tool writes pentest reports with AI on your own key or your own hardware: a finished finding from rough evidence, any one field redone to your instructions, the executive and retest summaries, your own sections, library entries, and your Word template made from a report you already send. Each request goes from your server to the provider you chose, or from your browser to Ollama, and none of it passes through Pental. Self-hosting a free pentest reporting tool installs it with one command.

Choose a provider

An administrator sets the AI up under Settings, AI. AI Provider offers Groq, OpenAI, Anthropic Claude, Ollama and a Custom Endpoint, and for Groq, OpenAI and Anthropic the screen says whether the model it recommends reads screenshots. The Model list starts on the recommended model where there is one, and once a key is saved it lists every model the key can use, newest first; for Ollama it lists the models installed, and for your own endpoint the models it offers. Until a key is saved, an AI button says an administrator needs to save one.

Requests a minute has no limit unless you set one, and Fields written at once sets how many fields Generate all asks for together: automatically four for a hosted model, two for your own endpoint and one for Ollama. Save AI Settings, then Test Connection: it saves, sends one short request and says which model answered.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Where each request goes

A request carries the prompt for the field or section being written, with the finding’s context and evidence or the engagement’s findings, and screenshots where a step reads them. A backup leaves your AI key out.

Generate all from evidence

Paste what you captured into a finding’s evidence as rough as it was taken: notes, tool output, requests, tables and screenshots. Generate all from evidence turns it into a finished finding. It explains each piece of evidence and captions every screenshot, tidies your notes into report sentences with every value kept and the to-dos left out, names the finding if it has no title, and brings in the library entry with that title. Then it writes the description, remediation, CVSS vector, CWE, category, affected assets, your own fields and the references, several at once, in the order they depend on each other.

Only empty fields are written, so anything already there stays as it is. While it runs, Stop keeps what is written and asks for nothing more. When it finishes, Ask again retries any field that failed, and Undo puts back every field it wrote that nobody has changed since.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

A button on every field

Most fields have a button of their own too, so one part can be redone and the rest kept: Classify for the category from your own list and for the CWE, Calculate for the CVSS vector, Generate for the description, remediation, references and each of your own fields, and Choose from scope and evidence for the affected assets. Explain evidence writes a line above each screenshot, request, block of code, output or table saying what it shows, and a caption under each screenshot.

Instructions for one field

Beside each AI button is a control for instructions of your own, such as giving a remediation’s steps for the client’s IIS servers, or ready-made ones: Shorter, More detail or Plain English for prose, Numbered steps or Quick fix first for a remediation, For the board or Most serious first for the executive summary, and Name the host or Short captions for evidence. On a field that already has text, the instructions are applied to what is there, only that field changes, and the message that follows puts it back with one click. Remember offers them again next time.

Summaries and sections

On an engagement, the executive summary’s editor has Generate with AI, which drafts it from the findings in the assessment. It is set out as its prompt says, under Settings, Assessments: the built-in one keeps one structure across an engagement’s phases, and yours can give each phase a section of its own. The retest summary, the notes, the caveats and every section of your own are drafted the same way, each from a prompt of its own.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Library entries and your Word template

A library entry has its own Generate all, which fills whatever is empty from the entry’s title: the description, remediation, score, category, CWE, references and your own reusable fields. The Document Builder, under Settings, PDF & DOCX, turns a Word report you already send into your template: the AI takes the last engagement out and puts the tool’s fields where it was, every change is marked for you to check and undo, and you preview the real pages before saving. The document goes to your AI provider and nowhere else. Branding pentest reports in the free reporting tool covers the template itself.

Your own prompts

Nothing the AI is asked is hidden from you. Every field it writes has an AI prompt under Settings, Findings, and every section one under Settings, Assessments, each yours to rewrite in your firm’s voice: how a description opens, what a remediation covers, how much a summary says. Your own fields and sections get prompts of their own, and Reset to default puts the built-in prompt back.

With the AI set up, from finding to Word report takes a whole engagement through the tool.