Findings come in from the output of the tools your testers already run, sixteen formats of it, and go out to the tracker your client's engineers already work in, Jira, ServiceNow, Azure DevOps, GitHub, GitLab and Linear, with the ticket's state read back. Around them: Google and Microsoft sign-in, email from your own address, the password managers credentials go to, your own AI, and every finding in a Postgres database you can query yourself, alongside the client portal, QA and automation.
A finding is fixed in the client's tracker, not in a PDF. Pental puts it there and reads it back, so a ticket closed by an engineer becomes a retest for your team rather than a finding quietly marked done.
Most engagements include scanner output. Pental imports it into the phase it belongs to as findings like any other, grouped by issue and written in your own words where your library has them, and nothing is written until you have seen what the file holds.
| Format | What is read |
|---|---|
| Nessus and Tenable | the .nessus file, and the Nessus, Tenable Vulnerability Management and Security Center CSV exports |
| Greenbone / OpenVAS | the XML report and the CSV results |
| Burp Suite | the XML issue export |
| Nmap | XML output: open ports, and what its vulnerability scripts report |
| OWASP ZAP | the XML and JSON reports |
| Nuclei | JSON lines, or its JSON export |
| SARIF | any tool that writes it, CodeQL and Semgrep included |
| Semgrep | its own JSON |
| Trivy | the JSON report: vulnerabilities, misconfigurations and secrets |
| Acunetix | the XML export |
| Qualys | host reports, scan results and web application reports in XML, and the CSV scan report |
| Nikto | XML and JSON output |
| testssl.sh | JSON output, flat or pretty |
| Wapiti | the JSON report |
| CSV | any scanner that exports a table, separated by commas or semicolons |
| Generic JSON | a list of objects with recognisable keys |
Yes, both ways, Jira Cloud and Jira Data Center or Server alike, and with GitHub, GitLab and Linear as well; anything else can take findings from a one-way webhook. A finding becomes a ticket in the client’s tracker in one click, or automatically as each finding is released from the lowest severity you choose, with its details and how to fix it. Every tracker is read back each hour, and Sync now does it at once. When the client’s engineers close the ticket, Pental asks your team for a retest rather than closing the finding; once the fix is checked, the finding is closed and so is the ticket.
Yes, in sixteen formats: Nessus and Tenable, Greenbone / OpenVAS, Burp Suite, Nmap, OWASP ZAP, Nuclei, SARIF, Semgrep, Trivy, Acunetix, Qualys, Nikto, testssl.sh, Wapiti, CSV and Generic JSON. Results with the same title become one finding listing every affected host, with the worst severity, the highest CVSS score and its vector, and each host’s output kept as evidence; where your findings library has the issue, the finding takes your wording. A later scan adds hosts to the findings already there rather than duplicating them, and nothing is written until you have seen what the file holds.
Yes, directly. Every finding, report and file is in your own Postgres database, so anything that can read Postgres can query it with your own credentials: a BI tool, a script, or your SIEM’s database connector. The whole portal can also be exported as one archive, files included.
Yes. An in-house team sets up each business unit or product team it tests as a client, so their engineers have accounts of their own to read findings and ask for retests, and each team’s own Jira, ServiceNow, Azure DevOps, GitHub, GitLab or Linear can be connected, with tickets raised as findings are released. Findings come from your testers’ evidence or from the output of the tools you already run, and everything stays in your own database.
Notifications go by email, with a switch for each event, from testing starting or a critical finding raised to a report delivered, and security alerts go to the person affected or an administrator when a device signs in for the first time, a second factor or a role changes, or a user is added. Your team and your clients sign in on your own branded page with a mandatory second factor, a passkey or an authenticator app, and Google or Microsoft single sign-on can be turned on, Microsoft limited to your own directory if you choose.
Start a free trial, import the output of your last engagement into a phase, and push a finding to a tracker. A free trial of the whole Portal, no card required, and its days start when your portal goes live.