Skip to content
SPECIFICTION
Get listed

Pentesterra

pentesterra.com

From €23/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit pentesterra.com
Spec score 8.9 #1 of 34 in Penetration Testing Software

What it is

Pentesterra is a security orchestration platform combining vulnerability management, automated network and web pentesting, breach and attack simulation, and AI-assisted exploit verification. Its workflow links attack-surface mapping, simulation, and controlled exploitation, prioritizing findings with evidence. Web testing covers modern web apps, single-page applications, and APIs through public or private proxies and Tor, including authentication flows, CSRF, JWT, and WAF evasion. Safe exploit validation uses real-world tools in non-malicious modes and is described as involving no malware or ransomware. Attack Chain Analysis turns web, network, and DevGuard findings into directed kill-chain graphs, with up to 20 paths at depth five or less. Deployment is available as SaaS, dedicated PaaS, or fully air-gapped on-premises. Integrations include Jira ticket creation from verified findings and a REST API for scans, results, and reporting. Enterprise options add SIEM export, ticketing integrations, SSO, and compliance evidence packages. Plans range from a free DevGuard Free tier to Vibe Coding at €23/month; higher tiers list specific scan and project limits, while Enterprise pricing is custom.

Spec sheet

What it does
Pentesterra combines vulnerability management, attack-surface mapping, breach-and-attack simulation, automated pentesting and code security in one control plane.Read 15 Oct 2026 · pentesterra.com
Deployment
The platform is deployable as SaaS, dedicated PaaS, or fully air-gapped on-premises.Read 1 Oct 2026 · pentesterra.com
Integrations
Published integrations include Jira ticket creation, ServiceNow, SIEM CEF/JSON export, SAML/OIDC SSO and CI/CD workflows.Read 15 Oct 2026 · pentesterra.com
Support
The licensing matrix lists 24x7 support for VM, ANPT, BAS, Web pentesting, MSSP and GOV tiers.Read 1 Oct 2026 · pentesterra.com
Headquarters
ItalyRead 23 Sep 2026 · pentesterra.com
Founded
2021Read 23 Sep 2026 · pentesterra.com
Active Directory testing
The platform automates AD enumeration, ACL analysis, credential-abuse simulation and safe lateral-movement validation.Read 15 Oct 2026 · pentesterra.com
Attack-chain analysis
Pentesterra correlates code, web and network findings into directed attack paths mapped to kill-chain phases.Read 15 Oct 2026 · pentesterra.com
Automated network pentesting
Its network pentest module performs controlled exploit validation for internal and external exposure with operational guardrails.Read 15 Oct 2026 · pentesterra.com
Breach and attack simulation
BAS scenarios test whether defensive controls work and expose realistic attack paths.Read 15 Oct 2026 · pentesterra.com
Build extensibility
The extension is described as TypeScript orchestrating a Python CLI and Pentesterra API, and it can be built into a VSIX from source.Read 15 Oct 2026 · marketplace.visualstudio.com
CLI requirement
The DevGuard CLI requires Python 3.9 or newer and installs with pip as pentesterra-devguard.Read 15 Oct 2026 · pentesterra.com
Company facts
LinkedIn lists Pentesterra as a computer and network security company founded in 2021 with 2–10 employees and public-company status.Read 15 Oct 2026 · linkedin.com
Compliance evidence
Enterprise plans provide per-cycle evidence packages for SOC 2, ISO 27001, PCI-DSS and NIST CSF, including per-finding proofs of concept and delta reports.Read 1 Oct 2026 · pentesterra.com
Core workflow
Pentesterra combines vulnerability management, attack-surface mapping, breach simulation and controlled exploitation into a continuous workflow with evidence-first prioritization.Read 1 Oct 2026 · pentesterra.com
Data protection
Pentesterra states that it uses end-to-end encryption, credential-vault isolation, per-scope processing isolation and distributed scanner isolation.Read 1 Oct 2026 · pentesterra.com
Deployment options
Deployments include managed SaaS, dedicated PaaS, hybrid scanner nodes, full on-premises operation and an air-gapped GOV edition.Read 15 Oct 2026 · pentesterra.com
Developer extension
The VS Code Marketplace extension supports VS Code, Cursor and Windsurf and can install the CLI automatically.Read 15 Oct 2026 · marketplace.visualstudio.com
DevGuard platforms
DevGuard offers a pre-built binary CLI for Linux, macOS Intel, macOS Apple Silicon and Windows, plus extensions for VS Code, Cursor and Windsurf.Read 1 Oct 2026 · pentesterra.com
DevGuard privacy
DevGuard does not upload source code or transmit raw secrets; it sends metadata and redacted findings for cloud analysis.Read 1 Oct 2026 · pentesterra.com
Documentation
The public DevGuard guide covers API-key creation, CLI installation, project initialization, scans, JSON output, IDE use, privacy, ecosystems and troubleshooting.Read 15 Oct 2026 · pentesterra.com
Dynamic Rule Security Engine
DRSE is a programmable rule layer that can trigger rescans, alerts or enrichment workflows from scan events.Read 15 Oct 2026 · pentesterra.com
Enterprise integrations
Enterprise integrations include SIEM export in CEF or JSON, Jira and ServiceNow auto-ticketing, SAML 2.0 or OIDC SSO, and a REST API.Read 1 Oct 2026 · pentesterra.com
Exploit validation
Safe exploit validation uses real-world tools in non-malicious modes and is described as having no malware or ransomware.Read 1 Oct 2026 · pentesterra.com
Exploit verification
Findings can be validated with non-destructive verify-only or exploit-mode scripts and evidence is attached to reports.Read 15 Oct 2026 · pentesterra.com
Founder
Pentesterra identifies Olesia Shelestova as founder and CEO and places headquarters in Italy.Read 15 Oct 2026 · pentesterra.com
Independent package record
The piwheels mirror lists pentesterra-devguard version 1.4.24 released 2026-07-06, with 13 files and 16 all-time downloads recorded on that page.Read 15 Oct 2026 · piwheels.org
Limit: analysis latency
The extension troubleshooting notes that server-side LLM enrichment for large projects can take one to two minutes and may appear stuck.Read 15 Oct 2026 · marketplace.visualstudio.com
Limit: pricing transparency
Enterprise pricing is custom rather than published, and annual billing is described only as saving up to 24 percent.Read 15 Oct 2026 · pentesterra.com
Limit: quota dependence
The extension documentation warns that projects with more than 1,000 dependencies may hit tier limits.Read 15 Oct 2026 · marketplace.visualstudio.com
Pre-push gate
DevGuard installs a Git pre-push hook that can block pushes at critical, high or medium severity thresholds, with a no-verify bypass.Read 15 Oct 2026 · marketplace.visualstudio.com
Product scope
Pentesterra unifies vulnerability management, automated network and web pentesting, breach and attack simulation, and AI-assisted exploit verification in one orchestration platform.Read 1 Oct 2026 · pentesterra.com
Public API
Pentesterra states that its REST API can launch scans, manage jobs, retrieve results and pull reports for automation.Read 15 Oct 2026 · pentesterra.com
Release news
The 2026-07-06 release added SARIF export, SVN history scanning and configurable CI failure thresholds to DevGuard.Read 15 Oct 2026 · pentesterra.com
Security and compliance
Pentesterra advertises evidence packs for NIS2, GDPR, ISO 27001/27701, DORA, SOC 2, NIST CSF, PCI DSS, CMMC, TISAX, CRA, HIPAA and NYDFS 500.Read 15 Oct 2026 · pentesterra.com
Source privacy
DevGuard says it sends metadata and masked secret fingerprints rather than source code or raw credentials.Read 15 Oct 2026 · marketplace.visualstudio.com
Supported ecosystems
The extension lists parsers for npm, Python, Go, Rust, Ruby, PHP, Java/Kotlin, .NET, Swift and Dart lockfiles or manifests.Read 15 Oct 2026 · marketplace.visualstudio.com
System scale
The enterprise offering supports scanner nodes as Docker containers or VMs across cloud and on-premises environments.Read 15 Oct 2026 · pentesterra.com
Target customers
Pentesterra says its platform is designed for internal teams, MSSPs and regulated environments.Read 1 Oct 2026 · pentesterra.com
Vulnerability management
The platform continuously discovers vulnerabilities, correlates assets and CVEs, scores risk by context and supports retesting workflows.Read 15 Oct 2026 · pentesterra.com
Web and API testing
The web engine tests REST, GraphQL and modern web applications for injection, authentication, authorization, business-logic and OWASP API risks.Read 15 Oct 2026 · pentesterra.com
Web testing
Web pentesting supports modern web, SPA and API testing through public or private proxies and Tor, including authentication flows, CSRF, JWT and WAF evasion.Read 1 Oct 2026 · pentesterra.com

Plans and prices

DevGuard Free Free 1 project · 3 scans/mo · CLI, IDE plugin and web console · community support Read 15 Oct 2026 · pentesterra.com
Vibe Coding €23 a month €23/ month 3 projects · 20 scans/mo · 300 dependencies/scan · 14-day raw-data retention · limited network scanning Read 15 Oct 2026 · pentesterra.com
Vibe Coding Pro €75 a month €75/ month 5 projects · 40 scans/mo · 500 dependencies · 90-day retention · limited web pentest · 1 report/day and 4/week · performance scanner node Read 15 Oct 2026 · pentesterra.com
Small Team €299 a month €299/ month Full web pentest · 10 network hosts · 10 network launches/week · 12 DevGuard projects · 60 scans/mo · 4 reports/day and 10/week · limited CI/CD integration · SOC 2, ISO 27001, PCI DSS and NIST packs Read 15 Oct 2026 · pentesterra.com
Team (SMB) €1,299 a month €1,299/ month 100 network hosts · 20 web-pentest launches/week · 20 DevGuard projects · 140 scans/mo · 900 dependencies · 2 scanner nodes · internal scanning · gray/white-box, proxy and TOR support Read 15 Oct 2026 · pentesterra.com
Enterprise Priced on request Custom Unlimited modules, targets, nodes and seats · single-tenant or on-prem deployment · custom SLA · dedicated CSM · white-label and multi-tenant orchestration · SIEM hooks · API webhooks · SSO Read 15 Oct 2026 · pentesterra.com

Every Pentesterra plan and price →

Strong points and limits

Strong points

  • Offers SaaS, dedicated PaaS, and air-gapped on-premises deployment.
  • Tests web apps, APIs, and networks.
  • REST API supports scan and reporting automation.
  • Enterprise plans include compliance evidence packages.
  • Free DevGuard plan available.

Limits

  • Vibe Coding is limited to 20 scans per month.
  • Small Team plan costs €299/month.
  • Enterprise price is custom and not listed.

Who it suits

Pentesterra is aimed at internal security teams, MSSPs, and regulated environments. Its deployment choices and testing, integration, and evidence features suit organizations with different operational and compliance needs.

Pentesterra in depth

Read the full write-up

Overview

Pentesterra is a security testing and management platform for teams that want vulnerability findings, attack simulation and exploit validation in one workflow. It is best suited to internal security teams, MSSPs and organizations with compliance needs. Its broad scope and flexible deployment are strong draws, but plan quotas can constrain how much testing smaller teams can run.

Key features

Pentesterra connects vulnerability management and attack-surface mapping with breach simulation and controlled exploitation, then prioritizes findings with evidence. That joined-up approach can help teams concentrate on issues that form credible attack paths instead of triaging disconnected scan results.

Web testing covers modern applications, single-page apps and APIs, including authentication flows, CSRF, JWT and WAF evasion. Testing can use public or private proxies and Tor. Safe exploit validation uses real-world tools in non-malicious modes and is described as having no malware or ransomware; teams still need to keep testing within authorized scopes.

Attack Chain Analysis combines web, network and DevGuard findings into directed kill-chain graphs, with up to 20 paths at a depth of five or less. Jira ticket creation for verified findings and a REST API for scan triggers, results and reporting help connect assessment work to operations. Enterprise integrations add SIEM export in CEF or JSON, Jira and ServiceNow auto-ticketing, and SAML 2.0 or OIDC single sign-on.

DevGuard provides a CLI and extensions for VS Code, Cursor and Windsurf. Its CLI runs on Linux, macOS Intel and Apple Silicon, and Windows; source code and raw secrets are not uploaded, with metadata and redacted findings sent for cloud analysis. Enterprise plans add per-cycle evidence packages for SOC 2, ISO 27001, PCI-DSS and NIST CSF, including proofs of concept per finding and delta reports.

Deployment ranges from SaaS and dedicated PaaS to fully air-gapped on-premises installations. Pentesterra states that it uses end-to-end encryption, credential-vault isolation, per-scope processing isolation and distributed scanner isolation, an important consideration for teams handling sensitive assessment data.

Pricing

The free DevGuard Free plan costs nothing and allows one project and three scans per month, with CLI, IDE plugin, web console and community support. It is a narrow entry point for trying DevGuard, not a substitute for broader testing capacity.

Vibe Coding costs €23/ month and raises capacity to three projects and 20 scans per month, with up to 300 dependencies per scan, 14-day raw-data retention and limited network scanning. Vibe Coding Pro costs €75/ month for five projects, 40 scans per month and 500 dependencies, with 90-day retention and report limits of one per day and four per week. Pro suits users who need longer retention and more scanning headroom; both tiers remain bounded by project, scan and dependency quotas.

Small Team costs €299/ month and adds full web app pentesting, 10 network hosts, 10 launches per week, 12 projects and 60 scans per month, plus SOC 2, ISO 27001, PCI DSS and NIST packs. Team (SMB), at €1,299/ month, raises capacity to 100 network hosts, 20 web pentest launches per week, 20 projects and 140 scans per month, with 900 dependencies, two scanner nodes and internal network scanning. These tiers suit teams that need a defined testing and compliance capacity; the higher price buys substantially more scale and internal scanning.

Enterprise has custom pricing. It includes unlimited modules, nodes, targets and seats, single-tenant or on-premises deployment, a custom SLA, dedicated customer success management, white-label and multi-tenant orchestration, SIEM hooks, API webhooks and SSO. The licensing matrix lists 24x7 support for VM, ANPT, BAS, Web pentesting, MSSP and GOV tiers. Teams needing those enterprise controls should weigh custom pricing against the fixed quotas of lower plans.

Platforms

Pentesterra supports API, extension, Linux, macOS, self-hosted, web and Windows. The deployment choices make it relevant both to cloud-oriented teams and organizations that require an air-gapped installation.

Who it's for

Internal security teams can use it to connect vulnerability management, web and network testing, and attack simulation. MSSPs may benefit from multi-tenant orchestration at Enterprise level, while regulated organizations have a reason to consider the evidence packages and on-premises option. It is less compelling for buyers who need only a single-purpose tool or whose expected scan volume exceeds a lower tier’s caps.

Pros and cons

Pros: A continuous workflow joins vulnerability management, simulation and controlled validation, with evidence-based prioritization and attack-path views.

Pros: SaaS, dedicated PaaS and air-gapped on-premises deployment give teams meaningful control over where the platform runs.

Pros: DevGuard’s stated privacy approach avoids uploading source code and raw secrets, while enterprise evidence packages address common compliance frameworks.

Cons: Lower plans cap projects, scans, dependencies, hosts or launches, so buyers must match expected workload to the tier rather than assume broad access.

Cons: Enterprise capabilities such as unlimited seats, nodes and targets come with custom pricing rather than a fixed monthly amount.

Alternatives

Penetration Testing Software is the broader category for comparing tools. Dradis is a freemium option with a free, open-source Community Edition for one project at a time, making it a better fit when assessment collaboration is the priority. Caido has a free Basic tier with caps on projects, workflows, plugins, presets and concurrent pipeline sessions, so consider it when those limits fit the work. RedAmon is a free, MIT-licensed self-hosted Docker stack for teams seeking an open-source deployment. Kali Linux is a free, open-source distribution for users seeking a broader security toolkit. Aircrack-ng is a free software suite with no license fee. Burp Suite DAST offers a tailored solution with pricing based on portfolio, so it suits buyers prepared to contact PortSwigger for a quote. OWASP Amass is a free Apache-licensed framework. PenTest.WS has a Hobby Tier at $4.95 monthly, with yearly billing also shown at 33% savings.

Verdict

Pentesterra is a strong candidate for security teams that want assessment, validation and evidence workflows under one deployment umbrella, especially where air-gapped operation or compliance matters. Choose it for that breadth and operational integration; look elsewhere if a focused tool or predictable capacity beyond the lower plans’ quotas is more important.

Verdict

Pentesterra brings several security testing and management activities into one orchestration platform. Review the plan-specific scan limits, deployment model, and enterprise features before choosing a tier.

Where Specifiction places it

Alternatives to PentesterraAll alternatives →