Sell the Relationship, Not the PDF.

What Changes When Testing Becomes a Service.

A project ends when the report is emailed. A service does not, and almost everything that makes the difference happens in the months where a project-shaped tool has nothing to say.

A Portal That Is Still There in Month Seven.

Client accounts in Pental are standing accounts on your own domain, not a share link that expires. Between engagements the portal is where their whole history with you sits; during one, it is where they scope, watch and receive.

• Their record, not a deliveryEvery engagement you have run for that client stays available to them: reports, findings and their current state, retest outcomes and attestation letters, a year later, without emailing you for a copy.
• Scoping in the portalTargets, credentials, environments and constraints are answered in a form attached to the engagement, so the next round starts from what the last one established rather than from a blank email.
• Credentials handled properlyAccess credentials the client submits arrive encrypted and one-time view against the engagement, which is the difference between a service and a shared mailbox.
• Their view, enforced below the interfaceA client sees its own organisation, its own assessments and only the findings you have released. That boundary is a database policy, not a hidden button.
• Questions in contextA query about a finding is raised against that finding, so the context is attached rather than arriving as a thread someone has to reconstruct.

Findings Reach the Client the Day You Confirm Them.

Release is a separate act from saving. You write a finding, it stays internal while it is being checked, and it becomes visible to the client the moment you decide it should, which is what lets a client start fixing in week one instead of week four.

1. 01The finding is written, from evidence, and sits internal by default while anyone who needs to review it does.
2. 02QA runs against it as a workflow rather than a favour: review states, comments anchored to the passage they concern, and approval before release.
3. 03You release it. For a critical or high finding the platform asks first whether the client should be emailed about it now, because some of those are a phone call rather than a notification.
4. 04It appears in their portal with its severity, evidence, affected assets and remediation, under your brand, whether or not the report exists yet.
5. 05The report, when it comes, is generated from the same findings, so nothing has to be reconciled between what they were told and what they were sent.

Retests the Client Asks for Themselves.

The single most service-like thing a testing firm can offer is a fix being verified without a new sales conversation. In Pental the request starts where the client is already looking.

• Requested from the findingA client reading a released finding can ask for the retest there. It arrives on your side attached to the original, with its history rather than as a fresh ticket.
• A delta, not a rewriteA retest carries the original findings forward and tracks each as fixed, still open, or newly introduced, so the second document is about what changed.
• Its own phaseRetesting is a phase on the engagement with its own dates and testers, which means it is schedulable, assignable and billable like any other work.
• Per-phase controlRetesting can be switched on for the phases where it makes sense and left off elsewhere, so the offer matches what you actually sell.
• Closed loops are visibleWhere a client runs their own tracker, a closed ticket comes back as a signal to retest rather than as a claim that the issue is fixed.

Recurring Work That Schedules Itself.

A service that has to be re-sold every year is a project with better marketing. The proposal shapes in Pental are built for work that repeats, and signing one creates the engagements rather than a reminder to create them.

Proposals and invoicing are modules, so a firm that contracts its own way switches them off and keeps the rest. How the engagement runs

Something Happening in the Gaps.

Between two annual tests there are eleven months where a client is buying a relationship and receiving nothing. Scanning is what fills that, provided it is sold as what it is: coverage between tests, not testing.

• Scans on a cadence you sellDaily, weekly, monthly or annual, against assets you have approved, priced by you and charged through your own Stripe account or raised as an invoice.
• Or scans they ask forA client can request a scan themselves inside the caps, cooldown and window you set, which is a service they can feel without a phone call.
• Results a tester has seen firstOutput can land in a holding area for one of your people to read before the customer sees a word of it, which is the difference between your service and a scanner subscription.
• Its own documentScan output produces a vulnerability report, a separate document type, so it never turns up inside a penetration test report wearing the same clothes as tested findings.

What the Client Still Has a Year Later.

The renewal conversation is easy when the client has spent eleven months signing in to something with your name on it. This is what is waiting for them there.

• Every report you releasedIn one place, on your domain, when their auditor asks for last year's and their procurement team asks for the one before it.
• Attestation lettersThe letter confirming testing took place, generated as its own document type rather than written from scratch each time somebody asks.
• Findings and their current stateOpen, fixed, retested, and what was verified rather than assumed, which is the answer to most questions a customer of theirs will ask them.
• Coverage they can point atChecklists and runbooks can be marked client visible, so a client who wants to know what was actually tested can read it instead of taking your word for it.
• Feedback that compoundsStructured feedback at the end of an engagement, with a nudge towards a public review when it is glowing.

Your Name on It, Your Database Under It.

A service sold under someone else's branding is a reseller arrangement, and a service whose data sits in a vendor's database is a dependency you cannot answer questions about. Neither is true here.

• Your domain, your loginClients sign in at your address, on your sign-in page, in your colours. There is no Pental branding anywhere a client can look.
• Your documentsReports rendered from the Word template you already send, deterministically, so a client comparing this quarter with last sees only the findings change.
• Your databaseEvery client record, finding and file lives in a Postgres project you created in your own account, which is also the honest answer when a client asks where their vulnerabilities are stored.
• Your AIDrafting runs on your own provider key or a model on your own hardware, so nothing about your client's estate becomes someone else's traffic.