AttackForge vs Pentographer
AttackForge
attackforge.appPentographer
pentographer.comSide by side
| Figure | AttackForge | Pentographer |
|---|---|---|
| Price from | $50/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 2 |
| Spec score · Penetration Testing Software | 8.4 (#6) | 7.5 (#22) |
| API | The Self-Service REST API has more than 150 endpoints and is documented using OpenAPI v3. | Pentographer exposes a GraphQL API for querying and updating projects, findings, and playbooks; authenticated access is required for schema operations. |
Plans
AttackForge
- Pro$50 a month
- Team$150 a month
- Consultancy$300 a month
- SME$800 a month
- EnterprisePriced on request
In their own words
AttackForge
AttackForge has no write-up on Specifiction yet; its figures are above.
Pentographer
Pentographer is an open-source platform for managing security assessments, from findings and evidence through client reports. Findings can carry CVSS scores, risk and status tracking, evidence attachments, version history, and playbook links. Users can build reusable checklists mapped to OWASP, PTES, or their own framework; OWASP Top 10 (2021) is built in. Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with review required before saving and an Anthropic API key required. Pentographer creates branded reports with customizable templates and executive summaries, exporting to Word and PDF. Team workspaces provide owner, admin, member, and viewer roles, including read-only viewers. A GraphQL API handles projects, findings, and playbooks, while an MCP server supports Claude Desktop, Cursor, and compatible clients. Free cloud and MIT-licensed self-hosted plans are listed; self-hosting requires Node.js 20+ and PostgreSQL.