Findings where the fix happens. No PDF to re-key.
Invited for one engagement: accept the rules of engagement, read the scope, record findings with proof and retest the fixes — inside the client's own workspace, within the dates and addresses they allowed.
What this replaces
- Findings travel as a PDF attachment and come back as questions weeks later.
- The scope arrives in one email, the rules of engagement in another.
- A retest starts with asking which fixes actually went in.
What changes
- One engagement per invitation, limited to its dates and the IP addresses the client allowed.
- Findings land in the client's workspace directly, with proof attached and nothing to re-key.
- Rules of engagement accepted once, by hash, with the time and address recorded.
What you do here
- 1Accept the rules of engagement before the first request.
The accepted version is pinned by hash; if the rules change, access waits for a fresh acceptance.
Pentester portal - 2Read the scope, target by target.
Hosts, URLs and test parameters sit on the pentest itself, not in an email thread.
Scope - 3Record each finding with its proof.
Severity, steps, evidence and the suggested fix go in once — or import a batch from the template.
Findings - 4Keep working notes inside the engagement.
Notes stay with the pentest instead of a local file that leaves with the laptop.
Notes - 5Retest the fixes the client marks done.
Each retest result is recorded against the original finding, so closure rests on your check.
Retest - 6Build the report from what you recorded.
Executive, technical or retest reports generate from the findings; false positives stay out. Or upload your own.
Report
Where the role stops
One pentest: the one you were invited to. Inventory, vulnerabilities and the rest of the platform stay out of reach; access ends with the window.
Works with
AUDITExternal AuditorAssessment quality, not logistics.Two doors lead here. A scoped read-only role for a named account reads compliance, the control library, the documents and the risk register; an invitation code opens the six-tab auditor portal with no platform account at all.
APPSECAppSec LeadOne list of what to fix. Before the release ships.Scanners, pipelines and pentests feed one register per application. Rank fixes by what is actually exploited, gate releases on rules you wrote down and keep an SBOM per release for the CRA file.
OPSSecurity ManagerNothing falls through the cracks.Own the operational day: the vulnerability queue, incidents from triage to lessons learned, access certifications, hardening sign-offs and phishing rounds. Each carries an owner, a date and a record behind it.
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.