Pentest Today

Pentest Today is built for companies that need to prove their security posture without spending weeks pulling together scattered reports, policies, scans, and technical documentation. Instead of treating security reviews as a last-minute paperwork exercise, the platform brings penetration testing, security scanning, policy generation, and architecture documentation into one workflow.

For a growing SaaS company, a security questionnaire from a prospective enterprise customer can quickly become a serious sales bottleneck. The platform is designed to help teams respond with tangible evidence, including pentest reports, security policies, system architecture diagrams, and remediation documentation.

The approach is particularly useful for organizations preparing for customer security reviews or working toward frameworks such as SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS. Approved targets are scanned first, findings are reviewed, and the resulting documentation is prepared in a format that can be shared with security teams and auditors.

Key Features

• Human-verified penetration testing for approved targets.
• Authenticated and external security scans across web, API, and cloud environments.
• Automated finding triage, deduplication, and CVE/CVSS mapping.
• More than 20 policy templates for common security and compliance requirements.
• Automatically generated system architecture and data-flow diagrams.
• Client-ready penetration testing reports with evidence and reproduction steps.
• Retest and remediation letters for demonstrating that findings have been addressed.
• Security documentation mapped to multiple compliance frameworks.

User Interface

The platform keeps the workflow relatively straightforward: connect an approved target, let the security assessment run, review the validated findings, and export the resulting documentation. This makes it easier for engineering and compliance teams to work from the same set of evidence rather than maintaining separate spreadsheets, documents, and scan results.

The policy library is another practical part of the experience. Instead of starting every document from an empty page, users can work with prepared templates covering areas such as access control, cryptography, data handling, incident response, business continuity, vendor risk, and change management.

Accuracy & Performance

A useful distinction is that the service does not position automated scanning as the final answer. Automated coverage is used to examine the approved attack surface, while findings are subsequently reviewed by humans to validate exploitability and reduce false positives.

That combination matters when a report is going to a potential enterprise customer. A long list of unverified scanner alerts is rarely persuasive. Verified findings, supporting evidence, reproduction steps, remediation guidance, and retesting provide a much more useful picture of the actual security posture.

The company states that many reports can be turned around in hours rather than weeks, making the service particularly attractive when a security review is blocking an otherwise ready-to-close business deal.

Capabilities

The platform covers several parts of the security-review process. Security scans can examine web applications, APIs, and cloud environments, while penetration testing produces a more detailed assessment of approved targets.

Beyond technical testing, the documentation side is substantial. Teams can generate policies, incident-response plans, vendor-risk documentation, evidence collections, and system architecture diagrams. The result is a broader security-review package rather than a standalone vulnerability report.

The methodology also references OWASP and PTES-aligned approaches, while findings can be mapped to CVE and CVSS information. For teams dealing with customer questionnaires, this can make technical results easier to understand and present.

Security & Privacy

Security testing requires clear authorization, and the platform explicitly operates on approved targets. Users add a domain, API, or cloud account they own and establish the testing scope before an assessment begins.

This approved-target model is important because penetration testing should never be performed against systems without authorization. The workflow is designed around controlled assessments rather than unrestricted scanning.

The resulting reports and evidence are intended to help organizations demonstrate their own security controls to customers, auditors, and compliance teams while keeping the assessment tied to the real environment being reviewed.

Use Cases

Enterprise security reviews: SaaS companies selling to larger organizations can use the generated pentest reports, policies, and diagrams to answer demanding vendor-security questionnaires.

SOC 2 preparation: Teams preparing for SOC 2 can use security testing and mapped policy documentation as part of their broader evidence-gathering process.

ISO 27001 readiness: Organizations working toward ISO 27001 can use the policy and security documentation capabilities to organize evidence around relevant controls.

Customer-requested penetration testing: When a prospective customer requires a recent penetration test before signing a contract, an approved-target assessment can provide the required report and supporting evidence.

Security remediation: Engineering teams can use validated findings, reproduction information, and remediation guidance to understand what needs attention and subsequently document completed fixes through retesting.

Vendor and compliance documentation: Companies facing platforms such as Vanta or similar security-review processes can prepare the technical and policy evidence needed to satisfy requested controls.

Pros and Cons

Pros

• Combines scanning, penetration testing, and security documentation in one workflow.
• Human verification helps distinguish meaningful findings from raw scanner output.
• Provides client-ready pentest reports and retest documentation.
• Includes a broad policy library rather than focusing only on technical vulnerabilities.
• Supports multiple widely used compliance frameworks.
• System architecture diagrams can be generated as part of the review package.
• Flat annual pricing avoids per-seat pricing surprises.

Cons

• The service is primarily designed for organizations with genuine security-review or compliance needs rather than casual security testing.
• Testing is restricted to approved targets, so it is not intended for unrestricted security research against third-party systems.
• Companies that already have mature internal security and compliance teams may find some documentation features overlap with existing processes.
• The annual plan may be more than smaller teams want to spend if they only need an occasional penetration test.

Pricing Plans

The current pricing structure is intentionally simple: one annual plan priced at $499 per year. There are no separate per-seat charges listed for the core offering.

The plan includes unlimited scans on approved targets, human-verified penetration tests, client-ready pentest reports, retest letters, 13 audit-ready policy documents, system architecture diagrams, and mapping to SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS.

For a company that regularly encounters enterprise security reviews, having these capabilities bundled together can be more economical than purchasing separate scanning, pentesting, policy, and documentation services.

How to Use the Platform

1. Connect an approved domain, API, or cloud environment that you own.
2. Define the authorized testing scope before starting the assessment.
3. Run the appropriate security scan or penetration test.
4. Review the findings after automated analysis and human validation.
5. Use the evidence, reproduction steps, and remediation guidance to address relevant issues.
6. Generate the required policies and system architecture documentation.
7. Export the finished reports and documentation for your customer, auditor, or security-review team.

Comparison with Similar Tools

Many security products concentrate on one part of the problem. Vulnerability scanners are excellent for identifying potential weaknesses, while compliance platforms are useful for collecting evidence and tracking controls. Traditional penetration-testing providers, meanwhile, generally focus on producing a dedicated security assessment.

This platform takes a broader route by connecting security scanning and human-verified penetration testing with the documentation required during enterprise reviews. That makes it especially interesting for SaaS businesses where the immediate goal is not simply finding vulnerabilities, but turning security work into evidence that a prospective customer can actually review.

The distinction becomes clearer during a sales process. A developer may need technical findings, an engineering leader may need remediation information, and a customer security team may ask for policies, architecture diagrams, and a formal pentest report. Bringing those deliverables together can reduce the amount of manual coordination required between teams.

Conclusion

For companies trying to move through enterprise security reviews without turning every questionnaire into a weeks-long project, this platform offers a practical combination of technical assessment and compliance documentation. Its strongest point is the connection between automated security coverage and human-verified results, followed by reports and documentation that are ready to share.

The inclusion of policy templates, architecture diagrams, retest letters, and framework mappings makes the service more than a conventional vulnerability scanner. It is aimed at the real-world situation where security evidence can directly influence whether an enterprise customer is comfortable signing a contract.

For a growing SaaS business, that can be a meaningful advantage: identify the issues, document the controls, prepare the evidence, and approach the next security review with the paperwork already organized.

Frequently Asked Questions (FAQ)

What is the main purpose of the platform?

Its main purpose is to help companies prepare for enterprise security reviews by combining security scans, human-verified penetration testing, policies, reports, and architecture documentation.

Does it provide actual penetration testing?

Yes. Approved-target scans can be turned into penetration testing reports containing validated findings, evidence, reproduction steps, remediation guidance, and retest documentation.

Can it scan APIs and cloud environments?

Yes. The service supports authenticated and external scanning across web applications, APIs, and cloud environments.

Are the security findings reviewed by humans?

Yes. Automated scanning and triage are followed by human validation intended to confirm exploitability and remove false positives before the findings are included in the final assessment.

Which compliance frameworks are supported?

The platform currently maps its documentation to SOC 2, ISO 27001, HIPAA, GDPR, and PCI DSS.

Does it generate security policies?

Yes. Its policy library includes more than 20 templates covering areas such as access control, cryptography, data handling, incident response, business continuity, vendor risk, and change management.

Can it generate an architecture diagram?

Yes. The service can generate system architecture and data-flow diagrams intended to help organizations provide the documentation commonly requested during security reviews.

How much does the service cost?

The current listed price is $499 per year for the main plan, including scans, human-verified penetration tests, reports, retest letters, policy documents, architecture diagrams, and compliance mappings.

Can I test any website with it?

No. Security testing is intended for approved targets. Users are expected to provide a domain, API, or cloud account they own and authorize for testing.

Who can benefit most from it?

It is particularly suitable for SaaS companies and growing businesses that sell to enterprise customers, face vendor-security questionnaires, or need organized security evidence for compliance and audit preparation.