Enterprise DNA

Instead of PlexTrac

Stop renting PlexTrac. Own your pentest reporting system.

We build your version around how your consultancy scopes, tests, reviews and reports, bring your PlexTrac findings and write-up library across, and run it for you. Your report template, your rules of engagement, your records.

PlexTrac publishes no prices: its Service Provider packages come in Essential, Core and Premium tiers behind a pricing form, with extra features sold as an add-on.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

What the subscription charges for

Paying a platform fee for records you already keep

PlexTrac is sold as one platform for reporting, scheduling, a content library, analytics and a client portal. Underneath, a consultancy keeps a short list of records: who signed, what was in scope, what was found, who reviewed it, and whether the fix held.

request_quote

A quote, not a price list

Every Service Provider tier is priced through a form. You learn the bill after a sales call, and again at renewal.

stacks

Tiers that gate the workflow

Essential, Core and Premium are separate packages. The features listed across them include scheduling, analytics, a client portal, ticketing integrations and workflow automation, and what you get depends on the package you buy.

add_shopping_cart

Add-ons on top of the tier

Some features are sold separately for any tier and need the cloud version to run at all.

groups

A bill that tracks your headcount

Commercial reporting platforms price by tester or by seat. Every graduate you hire and every reviewer you add moves the number.

bar_chart

The analytics they chose to build

Which findings recur across your clients, which engagements ran over the days quoted, how often a retest fails: you get the charts the vendor drew, not the questions you have.

lock

Years of client findings in their cloud

Clients ask for old reports and retest letters long after the engagement. Today that history sits with a vendor you have to keep paying.

Your own pentest desk

Start with the records your rules of engagement already require

Before testing

Nobody tests without a signature

Each engagement carries its scope, its exclusions and the client authorisation with the window it covers.

  • check Hours logged before the client signed, or outside the signed window, raised first, with section 252 of the Crimes Act or Part 10.7 of the Criminal Code beside it
  • check An authorised engagement with nothing listed in scope flagged before anyone starts
  • check An authorisation letter drafted from the scope, the exclusions, the testers and the dates, ready for the client to sign
  • check Engagements starting within five days with no signature listed every morning

Findings

Every finding scored, reviewed and told

Findings start from your own write-up library and carry their score, the affected asset and where the evidence is kept.

  • check A severity that does not match its CVSS v4.0 band is refused before it reaches a report
  • check A second tester reviews every finding, and the tester who found it cannot sign it off
  • check Critical findings counted against your one-day notice to the client, with the notice drafted
  • check Which findings keep turning up at different clients, so your library and your advice improve

The report

Reports out on time, and held until they are ready

Testing ending starts the report clock in working days, skipping weekends and the holidays you record.

  • check The report drafted from the records: summary counts, authorisation, scope, testers and every finding with its evidence reference
  • check Delivery refused while a finding is unreviewed or a critical has not been told to the client
  • check Late and nearly due reports at the top of the morning list
  • check Days used against days quoted on every engagement, so overruns show before the invoice

After delivery

Retests, PCI DSS dates and client data handled

Each finding carries its fix-by date, the client's claimed fix and the retest that confirms it.

  • check Fix-by dates of 48 hours for critical and two weeks for high, from the ASD Essential Eight, with your own dates for the rest
  • check PCI DSS clients' internal, external and segmentation tests counted against Requirement 11.4, every 6 months for a service provider's segmentation
  • check Exploitable PCI findings held open until a retest passes
  • check Client data destruction counted from delivery, and a letter of attestation drafted with counts only

Make it yours

Design your own PlexTrac replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from PlexTrac. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your PlexTrac replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your PlexTrac data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Real answers from a fictional New Zealand security consultancy with five testers and clients in New Zealand and Australia. The practice lead asks the question and checks the records behind the answer.

forum

Pentest Reporting for Claude Code

Connected to your own database

What needs my attention across the practice today?

testing without authorisation

Client
WTL
Ref
E-106
Detail
testing on 2026-10-14 by Mia Fraser with no signed authorisation

testing without authorisation

Client
KEA
Ref
E-107
Detail
authorised with nothing listed in scope

critical to notify

Client
THT
Ref
F-0006
Detail
SQL injection in appointment search on https://portal.example.org.nz/appointments/search
Due on
2026-10-03

report overdue

Client
THT
Ref
E-105
Detail
Web application test, patient portal
Due on
2026-10-16

report due

Client
SPP
Ref
E-111
Detail
Mobile application test, merchant app for iOS and Android (2 findings)
Due on
2026-10-29

QA waiting

Client
THT
Ref
E-105
Detail
1 finding(s) not reviewed

QA waiting

Client
WTL
Ref
E-106
Detail
1 finding(s) not reviewed

QA waiting

Client
SPP
Ref
E-111
Detail
2 finding(s) not reviewed

unsigned, starting soon

Client
PIB
Ref
E-108
Detail
planned to start 2026-10-26 and the authorisation is not signed

data to destroy

Client
KEA
Ref
E-109
Detail
delivered 2026-07-11
Due on
2026-10-09

retest requested

Client
KEA
Ref
F-0010
Detail
Insecure direct object reference on the reports API, client fixed 2026-10-18
Due on
2026-10-18

PCI test due

Client
HCU
Ref
HCU
Detail
internal test last 2025-09-12
Due on
2026-09-12

PCI test due

Client
SPP
Ref
SPP
Detail
segmentation test last 2026-04-01
Due on
2026-10-01

PCI test due

Client
HCU
Ref
HCU
Detail
external test last 2025-12-01
Due on
2026-12-01

PCI test due

Client
SPP
Ref
SPP
Detail
internal test never delivered

tester double booked

Ref
E-107
Detail
Hemi Walker also on E-108
Due on
2026-10-26

over budget

Client
THT
Ref
E-110
Detail
4.00 days used of 3.00 quoted

fix overdue

Client
HCU
Ref
F-0003
Detail
critical: Kerberoastable service account with domain admin rights
Due on
2025-09-14

fix overdue

Client
KEA
Ref
F-0010
Detail
high: Insecure direct object reference on the reports API
Due on
2026-07-25

Ask it anything

Questions answered from your practice records

These read across every client and every engagement at once. They are not a claim that PlexTrac cannot produce a similar report.

chat_bubble Which findings keep turning up across different clients?
chat_bubble How many working days from the end of testing to the report, by engagement type?
chat_bubble Which clients fix their critical and high findings, and how fast?
chat_bubble How often does a retest find the fix did not work?
chat_bubble Which engagements ran over the days we quoted?
chat_bubble How are testers spending their hours over the last 90 days?
chat_bubble Which open findings carry the most risk, client by client?
chat_bubble Which risks have clients accepted rather than fixed, and why?
chat_bubble Who finds the critical and high findings, and who reviews them?
chat_bubble Which PCI DSS clients need a test booked in the next 90 days?

Switching

How to switch from PlexTrac

The move involves exporting reports and writeups, mapping version-specific fields, and checking imported records before you stop using PlexTrac.

  1. 1

    Export reports and writeups

    Export each PlexTrac report as a standard CSV of findings. Export your writeups repository as CSV too if you want to move your finding library. The findings import expects one report per engagement. Export options can vary by account or version, so confirm what is available with PlexTrac before you start.

  2. 2

    Load the exported records

    Load the report CSVs as findings and the writeups CSV as the finding library. Start with the import's dry run so you can review how records will be read before loading them. The import is all or nothing and safe to repeat. Evidence images and delivered PDFs stay in your existing evidence store rather than being copied into the new system.

  3. 3

    Review what the import flags

    Check the dry-run results and any records or fields the import flags. PlexTrac headings differ between versions, so map them to the new fields before importing. Confirm that severity, score, affected assets, status and references have carried over as expected. Closed findings come across as retested and accepted findings as accepted. Check evidence locations too, since the files stay in your evidence store.

  4. 4

    Run both systems side by side

    Keep PlexTrac available while you check the imported records against current work. Use both systems for a short period, comparing active engagements and findings, and confirm your team can find evidence from its recorded location. This gives you a chance to spot missing history or workflow details before relying on the new records. Report templates and evidence files stay where they are.

  5. 5

    Switch off PlexTrac

    Once you have checked the records and your team is ready to work from the new system, switch off PlexTrac. Keep any reports, evidence files and templates you still need in their existing locations, since they do not transfer with the import. Make sure your team knows where to record new findings and how to find the imported history.

construction

Where the real effort goes

The main work is mapping your PlexTrac headings to the new fields, then deciding which history to bring across. Your own fields and rules may also need mapping to the way you work. Evidence images, delivered PDFs and report templates stay in their existing locations. If Enterprise DNA installs and runs the system for you, it handles the import mapping as part of that work.

Not ready for a call?

Get your PlexTrac switch plan by email

We will send you the step-by-step plan for moving your business off PlexTrac, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Three ways to make it yours

Start with the free pentest desk or have your version built

Open source

Do it yourself

Free code

  1. 1 Clone the repo and run npm install, npm test and npm run demo.
  2. 2 Open it in Claude Code, Codex, OpenCode or Cursor.
  3. 3 Export each PlexTrac report as Standard CSV and your writeups as CSV, and import them with a dry run first.
  4. 4 Add your testers, clients and holidays, then run /attention and /compliance every morning.
Get it on GitHub

Built around your business

We customise it

One setup fee, then a retainer

  • check Your engagement types, rules of engagement and report deadlines built in
  • check Your report, authorisation letter and retest letter in your own template and brand
  • check Your PlexTrac reports and write-up library brought across, with the headings mapped
  • check A client portal, scanner imports or a screen for your team, if you want one

Omni by Enterprise DNA

We run it for you

One setup fee, then a retainer

  • check Installed and operated through Omni by Enterprise DNA
  • check Every tester can log hours and findings, while client records stay inside the firm
  • check Unsigned testing, critical notices and late reports raised every morning
  • check Rules kept current as PCI DSS, CVSS and your contracts change
Book a call with Sam

Questions

Instead of PlexTrac, answered

Does this write the report for us? expand_more

It drafts the report from your records: the summary counts, the authorisation, the scope, the testers, and every finding with its score, description, recommendation and evidence reference, ordered by severity. Your lead tester writes the executive summary and the approach, and finishes it in your own Word or PDF template. We build your template into your version so the finished document comes out in your format.

What happens to the reports we already hold in PlexTrac? expand_more

PlexTrac exports each report as a Standard CSV of findings, and your writeups as CSV. Both come across, with severity, score, affected assets, status and references kept. Closed findings come across as retested and accepted ones as accepted. Evidence images and the delivered PDFs stay in your evidence store; each finding records where its evidence lives. Headings vary between PlexTrac versions, and mapping them is part of what we do.

Can we trust the rules it checks? expand_more

Each one is written down with its source: section 252 of the Crimes Act 1961 in New Zealand and Part 10.7 of the Criminal Code Act 1995 in Australia for testing only with a signed authorisation, the CVSS v4.0 severity bands, PCI DSS v4.0.1 Requirement 11.4, the ASD Essential Eight fix timeframes and the Privacy Acts for destroying client data. Your own rules of engagement sit beside them and change in one place. It is a records check, not legal advice.

How does the cost compare? expand_more

PlexTrac quotes privately, so we cannot put a number beside it. Published rivals show the shape of the bill: Dradis charges US$1,200 per seat per year from three seats, which is US$3,600 a year before you grow, and AttackForge charges US$800 a month for 20 testers. Your version is a one-off build and a retainer, with no charge per tester, per seat or per project.

What do we pay Enterprise DNA? expand_more

The code is free. A version built and run for your consultancy has one setup fee, then a retainer, with no charge per tester or per engagement. Sam reviews your current setup, your report template and your rules of engagement before agreeing the scope.

Own the records behind every test you run

Take 30 minutes with Sam to go through your PlexTrac setup, your report template and how your consultancy scopes and signs off work. We agree what your version needs before you change systems.

Book a 30-minute call with Sam Get the free version

Pentest Reporting for Claude Code is free and open source, published by Enterprise DNA.

Done paying for PlexTrac?

Get your version built