Enterprise DNA

Instead of DefectDojo Pro

Stop renting DefectDojo Pro. Own your remediation system.

We build your version around your review process, bring your DefectDojo findings across and run it for you. Your owners, evidence and risk decisions stay in a database you own.

DefectDojo lists $100 a month plus $0.15 per finding processed for Pay As You Go. Annual agreements are quoted separately. Dollar currency is not labelled on the pricing page.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

What the subscription covers

Pay for the platform you actually need

DefectDojo Pro includes aggregation and automation beyond this free desk. Compare the parts your team uses with a version built around your own remediation process.

paid

Platform fee and processed findings

The published monthly rate combines a base fee with usage. Annual agreements use a separately quoted allowance.

sync

Scheduled connections

Pro offers scheduled connections to security tools. Bring the connections you need into your custom version.

filter_alt

Cross-tool prioritisation

Pro combines findings and threat information. This free desk works from imported records and reviewed exposure facts.

schedule

Deadline enforcement

Pro includes breach alerting. Your owned desk shows internal deadlines and separately checks recorded online patch facts.

assessment

Management reporting

Pro offers executive reporting. Build your weekly review around the owners, exceptions and evidence your business uses.

lock

Access and operational support

Pro includes access controls and support. Enterprise DNA scopes those controls and ongoing operation for your version.

What you own

A remediation desk that follows the decision

Triage

Put an owner beside the finding

Read the open queue by severity and due date, then record the person responsible.

  • check Unassigned work is visible
  • check Overdue findings stay in the weekly review
  • check Owner workload includes high-priority work and retests
  • check Product names stay beside every finding

Evidence

A recorded fix still needs a retest

Separate a change being applied from evidence that the finding is resolved.

  • check Record the supplied change evidence
  • check Queue the finding for a retest
  • check Record the tester, result and evidence
  • check A failed test returns the work to remediation

Risk decisions

An acceptance has an expiry

Record an existing approval with its reason and evidence, then review it before it lapses.

  • check Named approver and evidence reference
  • check Expiry dates and days remaining
  • check Expired decisions return to the active queue
  • check Accepted risks remain visible in patch-guidance checks

Your weekly review

Keep the source and your decisions

Read the original imported values alongside your local notes and evidence.

  • check Preserved source values and import counts
  • check Branded remediation plans and risk records
  • check Read-only weekly reports in your colours
  • check Your own questions across deadlines, owners and approvals

Make it yours

Design your own DefectDojo Pro replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from DefectDojo Pro. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your DefectDojo Pro replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your DefectDojo Pro data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Real answers from the demo data that ships with Vulnerability Remediation for Claude Code. It runs in Claude Code inside the Claude app, so it feels like any chat you already use.

forum

Vulnerability Remediation for Claude Code

Connected to your own database

Which security findings need an owner or a fix first?

VUL-101

Title
Unsupported portal library
Product
Harbour Portal
Severity
Critical
Owner
UNASSIGNED
Status
open
Due_on
2026-10-16

VUL-104

Title
Legacy portal encryption
Product
Harbour Portal
Severity
High
Owner
Mere Rangi
Status
open
Due_on
2026-09-28

VUL-102

Title
API access check missing
Product
Dispatch API
Severity
High
Owner
Alex Chen
Status
In progress
Due_on
2026-10-25

VUL-103

Title
Report download permission
Product
Internal Reports
Severity
Medium
Owner
Morgan Lee
Status
Awaiting retest
Due_on
2026-11-16

VUL-105

Title
Unclassified dependency alert
Product
Dispatch API
Severity
Low
Owner
UNASSIGNED
Status
open
Due_on
2027-01-24

Ask it anything

Ten questions your records answer

These combine your own ownership and evidence policies. The demo answers each today; they are not claims that DefectDojo cannot report the same information.

chat_bubble Which overdue findings still have no accountable owner?
chat_bubble Which owner has the most overdue work alongside critical or high findings?
chat_bubble Which risk acceptances expired and are back in our triage queue?
chat_bubble Which accepted online risks still missed the patch guidance deadline?
chat_bubble Which online findings lack the dates or risk facts needed for a deadline?
chat_bubble Which fixes have no successful retest yet?
chat_bubble Which closed findings were verified after the guidance deadline?
chat_bubble Which unresolved records have not changed in seven days?
chat_bubble What did the imported source actually say before our local review?
chat_bubble Who recorded each ownership, fix and exception decision?

Switching

How to switch from DefectDojo Pro

A move usually involves exporting your findings, testing the import, checking the records and evidence you need to retain, then running both systems side by side before you switch.

  1. 1

    Export your findings

    Export the findings your DefectDojo Pro account allows, usually as CSV or Excel, and check with DefectDojo Pro if you are unsure what you can export. The replacement imports a findings CSV and product names. It does not bring across every DefectDojo Pro object, so keep the original export private and use it to check what still needs to be retained.

  2. 2

    Test the import

    Start with a test import before loading your working records. The import checks the whole file before writing and brings findings into an open review queue while preserving the source values. Compare the imported record count with the export. If the counts do not match, resolve that before treating the replacement as your working queue.

  3. 3

    Review import issues

    Check the import results for errors or records that need reconciliation. An overlapping or changed export stops for reconciliation rather than overwriting local decisions, so review those records before continuing. Also check whether you need to bring across attachments, users, integrations or risk acceptance objects. Those are not included in the findings import and need separate consideration before you retire DefectDojo Pro.

  4. 4

    Run both side by side

    Keep DefectDojo Pro available while your team reviews the imported findings in the new queue. Check ownership, deadlines, risk decisions and retest evidence against the source records, and agree which system people should update during the transition. Use this short parallel period to resolve differences and confirm that the records and evidence your team needs are available.

  5. 5

    Switch off DefectDojo Pro

    Once you have reconciled the findings and decided how to retain anything the import does not cover, make the replacement the working remediation queue. Confirm your team knows where to record new decisions and evidence. Keep any source exports or records you need for reference, then switch off DefectDojo Pro when you no longer rely on it for your remediation work.

construction

Where the real effort goes

The import is only part of the work. Most effort usually goes into mapping your own fields and rules, and deciding how much history and supporting evidence to bring across. Findings and product names are supported, but attachments, users, integrations and acceptance objects are not fully migrated by the import. When you have Enterprise DNA run it, they bring your findings across and map the rest of your evidence and history into your version.

Not ready for a call?

Get your DefectDojo Pro switch plan by email

We will send you the step-by-step plan for moving your business off DefectDojo Pro, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Three ways to own it

Choose who builds and runs your version

Open source

Do it yourself

Free source, your own running costs

  1. 1 Clone the repo and install the dependencies
  2. 2 Run npm test and npm run demo
  3. 3 Open it with Claude Code, Codex, OpenCode or Cursor
  4. 4 Trial your DefectDojo CSV import, reconcile the source records and review each finding
Get it on GitHub

Built around your business

We customise it

One setup fee, then a retainer

  • check Your product fields, deadlines and approval rules
  • check Your DefectDojo findings and evidence mapped across
  • check A web front end or a different stack when you need one
  • check Reports and connections built around your review process
Get your version built

Omni by Enterprise DNA

We run it for you

One setup fee, then a monthly retainer

  • check Installed in a database your business owns
  • check Your agreed access, backup and operating controls
  • check Your required connections and management reports
  • check Ongoing operation through Omni by Enterprise DNA
Talk to Sam

Questions

Instead of DefectDojo Pro, answered

Is DefectDojo already free? expand_more

Yes. DefectDojo Community Edition is free and open source. Keep it when its existing workflows suit you. This is a smaller independent remediation desk for a business that wants to change its own records, rules and reports.

What happens to our existing findings? expand_more

Export your findings as CSV and do a test import first. The free version preserves source values and brings findings into an open review queue. It does not assume an inactive source record proves a successful fix. Enterprise DNA maps the rest of your evidence and history into your version.

Does this scan systems or apply fixes? expand_more

The free version records remediation work and supplied retest evidence. Your existing tools still perform scans and changes. We scope and build the connections and screens your custom version needs before you switch.

Can we rely on the compliance report? expand_more

It checks the records you supply against internal deadlines and a limited set of cited Australian patch guidance for online services. Missing dates and risk facts are flagged. It does not certify security or replace an assessor, and a recorded approval name is not an authenticated signature.

What does Enterprise DNA charge? expand_more

One setup fee, then a retainer agreed around your records, connections and operating needs. We review your DefectDojo bill, the work your team actually does and the evidence you need to keep before scoping your version.

Make the next security review about the work

Spend 30 minutes with Sam. Bring your DefectDojo bill and one week of remediation work. We will look at the findings, ownership and evidence your version needs, then scope what we build and run for you.

Book 30 minutes with Sam Get the free version

Vulnerability Remediation for Claude Code is free and open source, published by Enterprise DNA.

Done paying for DefectDojo Pro?

Get your version built