Pentr
Sign in Start an engagement →
Audit-grade evidence · autonomous pen testing

Evidence, signed.

Pentr runs autonomous pen testing engagements against your estate (PCI, ISO, SOC 2, OWASP ASVS, NIST CSF, ENS) and seals every artifact in a tamper-evident locker your auditor will actually accept.

Run an engagement → Book a walkthrough
How it works ↓
How it works

Scope. Run. Seal.

Three operator actions. The agent owns everything in between.

01 · Scope

Point Pentr at an estate.

Hosts, CIDR ranges, wildcards, and a framework. The agent plans every phase from there. No playbook to author.

✓ Hosts & CIDR ✓ Authenticated routes ✓ Scope enforcement
02 · Run

The agent does the work.

Seven PTES phases in order: pre-engagement, intelligence, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting. Abort the whole run at any point — the locker keeps what's already sealed.

✓ Scope-locked ✓ Signed trace ✓ Audit log
03 · Seal

Hand auditors the locker.

Every artifact framework-mapped and tamper-evident. Auditors verify integrity offline with one command, pentr-verify pentr-locker-3f9a1c2e.zip --key acme.pem, and walk away. How the locker works →

✓ Signed at seal time ✓ Read-only share link ✓ CSV / PDF / SARIF export
The console · watch the agent work

Seven phases. Recorded, scoped, abortable.

A fixed PTES pipeline, run in order, in one place: every run, every finding, every artifact. Inspect an engagement down to the request/response pair the agent captured at the moment it found the bug. Every step is timestamped, signed, and sealed — and nothing executes outside the scope you declared.

01 Pre-engagement 02 Intelligence 03 Threat modeling 04 Vuln analysis 05 Exploitation 06 Post-exploitation 07 Reporting
Take a look inside →
A live run, end to end — scope locked, chain captured, locker sealed
Six frameworks · one console

Pick a standard. Pentr writes the playbook.

Every control catalog maps to a phase in the agent. Evidence comes back labelled with the control it satisfies — not just dropped in a folder.

PCI DSS v4.0

Cardholder data

Sections 11.3 + 11.4 evidence automatically mapped from external and internal pen tests. Quarterly cadence ready out of the box.

42 controls · Section 11→
 ISO/IEC 27001:2022

Technical controls

Annex A technical-vulnerability and security-testing evidence, packaged the way surveillance auditors expect to receive it.

Annex A · A.8.8→
 SOC 2

Continuous monitoring

Drop scheduled campaigns into your Trust Services control catalog. Share the locker link directly with your auditor.

CC7 series · weekly cadence→
 OWASP ASVS 4.0.3

Application verification

Verification requirements across chapters V1–V14, evidenced at the level you target — L1, L2, or L3 — with a real request/response proof per requirement.

14 chapters · L1–L3→
 NIST CSF 2.0

Cybersecurity Framework

Evidence mapped to CSF 2.0 Functions and Subcategories — Govern, Identify, Protect, Detect, Respond, Recover — in the outcomes language your risk team already reports in.

6 functions · CSF 2.0→
 ENS · RD 311/2022

Esquema Nacional de Seguridad

Spain's public-sector security framework. Pentr runs the vulnerability and penetration testing behind your MEDIA and ALTA measures and seals the evidence your ENS audit expects.

op.exp · MEDIA / ALTA→
Stand up your first engagement

Ninety seconds. One signed locker.

Plug in a scope and a framework. The agent does the work. You walk into the audit with evidence already accepted.

ENTRY
€150/mo
For one operator, one estate. Public framework registry, capped at 4 engagements/month.
  • 4 engagements / month
  • 30-day evidence retention
  • Community Slack
Start Entry
TEAM
€1,200/mo
For internal red teams and consultancies running for multiple clients in parallel.
  • Unlimited engagements
  • 1-year signed retention
  • All 6 frameworks
  • Auditor share-links
  • Slack + email support
Start 7-day pilot
ENTERPRISE
Custom
For regulated estates: SAML SSO, dedicated tenant, signed by your HSM, on-prem runners.
  • SSO + SCIM
  • HSM-backed signing
  • On-prem agent runners
  • Dedicated CSM
  • 99.9% SLA
Talk to sales
Full pricing →

Per-engagement. Not per-seat.

You shouldn't pay more for letting your whole security team see the same finding.

Run an engagement → Book a walkthrough
No credit card · 7-day pilot · cancel from the console
Frequently asked

What auditors and operators ask first.

Yes. That's the entire point. The locker is an append-only sha-256 chain, Ed25519-signed at seal time. Auditors verify integrity offline with pentr-verify pentr-locker-3f9a1c2e.zip --key acme.pem and receive control-mapped artifacts (e.g. PCI 11.3.1 next to the screenshot it satisfies) — packaged to the standard PCI QSAs, ISO surveillance auditors, and SOC 2 reviewers expect.
A scanner finds a possible issue. Pentr's agent attempts to exploit it, captures the chain end-to-end, and seals every step as evidence. The deliverable is a confirmed finding with a signed, re-viewable proof, not a CVE list to chase down. A longer comparison: AI pen testing vs vulnerability scanners.
By default, every locker is sealed with a platform-held Ed25519 key at seal time — so the chain is signed the moment the run ends, and Pentr cannot mutate or forge a sealed locker afterward. On Enterprise, you can bring your own HSM or KMS key so the locker is signed with a key only you control, and signing can run inside an on-prem runner.
Three real controls. Scope enforcement checks every command against your in- and out-of-scope CIDR ranges and domains — anything outside the declared scope is blocked, logged, and reported. A DoS-tool denylist keeps disruptive tooling out of the pipeline entirely. And you can abort the whole run from the console at any point; the locker keeps every artifact already sealed.
There's no self-serve custom playbook — the agent runs a fixed seven-phase PTES pipeline, not a user-authored script. But if you need evidence mapped to an internal or client-specific control catalog, our team sets that mapping up for you as a services engagement. Runs still seal to the same tamper-evident locker.
No. It gives them their week back. Operators use Pentr to cover the repeatable 70% (intelligence, threat modeling, vulnerability analysis, and common exploit chains) and spend their time on the bespoke 30% where humans still win. Consultancies use it to scale across more client estates without scaling headcount.