Penetration Test Management · Available now

Keep authorized targets and finding outcomes together.

Engagement Scopes records the client, authorized targets, testing window and authorization document for a penetration test. Security Findings link to an engagement and identify the affected asset, severity, evidence and progress through remediation and retesting.

Start now Download Proto

No per-user fees
Manual work is free
Configure it in Proto

OverviewCorrections for effectiveness review

Penetration Test Management · Corrective actions

Corrections for effectiveness review

close waits for the effectiveness reviewer

New corrective action

Corrective actions in view

Effectiveness review

Due date within 14 days

Nonconformance	Owner	Action	Due date	Status
Missing evidence for login check	Jonah Mercer	Obtain revised scope approval	03 Nov	Effectiveness review
Proof file absent from report	Jonah Mercer	Restrict scans to listed hosts	15 Oct	Effectiveness review
Proof file absent from report	Leila Haddad	Attach redacted request trace	27 Oct	Effectiveness review
Unapproved target in scan list	Maya Sen	Repeat access-control retest	01 Nov	Effectiveness review
Retest closed without approval	Maya Sen	Notify client security lead	19 Oct	Effectiveness review

6 of 6 records

Obtain revised scope approvalCorrective actions · CA-67648

Effectiveness review

NonconformanceMissing evidence for login check

OwnerJonah Mercer

Due date03 Nov

Review inspectionCA-67648 · Obtain revised scope approval

Inspection Reviewer decides the inspection disposition.

Waiting for Inspection Reviewer

ApproveReturn

Example screen with sample data

Tables, ready to use: 12
Saved views: 14
Roles with set permissions: 7
Reports and dashboards: 8

Features

Work from the authorized record

Every feature works on the same records. Pick one to see the screen your team works in.

Engagement scopes

Keep each client authorization, target set and testing window in one place.

Record the boundary
Keep authorization nearby
Trace a finding home

Engagement scopes

Explore engagement scopes

OverviewEngagement windows

Penetration Test Management · Engagement scopes

Engagement windows

Engagement scopes

New

Client name	Authorized targets	Starts at	Ends at	Authorization document
Cedar Vale Clinic external network	portal.cedarvale.example	22 Oct	28 Oct	cedar-vale-authorization.pdf
Marshline Finance customer portal	vpn.larkspur.example	11 Oct	18 Oct	marshline-test-consent.pdf
Larkspur Works staff VPN	api.ternfield.example	21 Oct	24 Oct	larkspur-scope-signoff.pdf
Blue Heron Labs cloud estate	10.42.8.0/24	17 Oct	23 Oct	blue-heron-approval.pdf
Ternfield Foods payment API	app.silverfern.example	17 Oct	21 Oct	ternfield-test-letter.pdf

6 of 6 records

Cedar Vale Clinic external networkEngagement scopes · ES-50453

Authorized targetsportal.cedarvale.example

Starts at22 Oct

Ends at28 Oct

Authorization documentcedar-vale-authorization.pdf

Example screen with sample data

Security findings

Follow an observed asset issue through remediation, retest and outcome.

Tie evidence to scope
Show the work state
Separate outcomes

Security findings
Engagement scopes

Explore security findings

OverviewFindings for retest

Penetration Test Management · Security findings

Findings for retest

Security findings

New

Engagement	Asset identifier	Severity	Evidence	Status
Silver Fern Transit mobile app	portal.cedarvale.example	Low	login-bypass-screen.png	Retest
Larkspur Works staff VPN	vpn.larkspur.example	Medium	api-response-redacted.json	Retest
Blue Heron Labs cloud estate	api.ternfield.example	High	vpn-access-log.txt	Retest
Marshline Finance customer portal	mail.westbrook.example	Critical	scope-approval.pdf	Retest
Westbrook Ledger internal network	10.42.8.17	Low	retest-capture.mp4	Retest

6 of 6 records

portal.cedarvale.exampleSecurity findings · SF-55203

Low

EngagementSilver Fern Transit mobile app

Evidencelogin-bypass-screen.png

StatusRetest

Example screen with sample data

Inspections and checks

Record assigned inspection work and requirement results with evidence.

Assign the inspection
Work each requirement
Submit complete checks

Inspections
Inspection checks
People

Explore inspections and checks

OverviewMy inspections

Penetration Test Management · Inspections and checks

My inspections

Inspections

New

Inspection number	Subject reference	Inspection type	Scheduled at	Status	Assigned to
INS-54294	Customer portal login flow	Incoming	18 Oct	Planned	Arjun Mehta
INS-96416	VPN administrator access	In process	24 Oct	In progress	Jonah Mercer
INS-49905	Payment API token handling	Final	25 Oct	Review	Malik Farah
INS-24151	Guest wireless isolation	Service	23 Oct	Accepted	Jonah Mercer
INS-92944	Cloud storage permissions	Incoming	31 Oct	Planned	Maya Sen

6 of 6 records

Customer portal login flowInspections · INS-54294

Incoming

Scheduled at18 Oct

StatusPlanned

Assigned toArjun Mehta

Example screen with sample data

Disposition and corrective actions

Review failed inspection scope and verify corrective work before closure.

Decide from checks
Track the issue
Verify independently

Inspections
Inspection checks
Nonconformances
Corrective actions
People

Explore disposition and corrective actions

OverviewInspections awaiting review

Penetration Test Management · Disposition and corrective actions

Inspections awaiting review

Approval conditions

New

Inspection number	Subject reference	Inspection type	Assigned to	Status
INS-86213	Customer portal login flow	Incoming	Leila Haddad	Review
INS-60587	VPN administrator access	In process	Nadia Okafor	Review
INS-81488	Payment API token handling	Final	Nadia Okafor	Review
INS-59213	Guest wireless isolation	Service	Hana Kim	Review
INS-18631	Cloud storage permissions	Incoming	Sofia Cruz	Review

6 of 6 records

Customer portal login flowInspections · INS-86213

Incoming

Assigned toLeila Haddad

StatusReview

Example screen with sample data

Audits and findings

Connect requirement findings to an audit scope, owner and due date.

Plan the audit
Describe the requirement
Check closure separately

Audits
Audit findings
People

Explore audits and findings

OverviewAudit findings due

Penetration Test Management · Audits and findings

Audit findings due

Audit findings

New

Audit	Requirement	Finding	Severity	Owner	Due date
Client notification process audit	Written client authorization	Scope approval date missing	Observation	Nadia Okafor	22 Oct
Scope exception audit	Targets match approved scope	Proof lacks request timestamp	Minor	Jonah Mercer	23 Oct
Report quality audit	Evidence stored in case folder	Excluded host scanned	Major	Theo Park	11 Oct
Year-end document control audit	Critical issues reported same day	Retest result unreviewed	Observation	Elias Navarro	18 Oct
Scope exception audit	Retest signed by reviewer	Report lacks client impact	Minor	Arjun Mehta	15 Oct

6 of 6 records

Written client authorizationAudit findings · AF-35089

Observation

AuditClient notification process audit

FindingScope approval date missing

OwnerNadia Okafor

Due date22 Oct

Closed at23 Oct

Example screen with sample data

Controlled documents

Keep approved document versions and person acknowledgments traceable.

Identify the version
Review the document
Record receipt

Controlled documents
Training acknowledgments
People

Explore controlled documents

OverviewDocuments under review

Penetration Test Management · Controlled documents

Documents under review

Controlled documents

New

Title	Version	Effective date	Status	Document
Rules of engagement	1.0	30 Oct	Review	rules-of-engagement-v2.pdf
Client authorization procedure	1.1	23 Oct	Review	evidence-standard-v1.pdf
Evidence handling standard	1.2	25 Oct	Review	retest-criteria-v3.pdf
Critical finding escalation plan	2.0	01 Nov	Review	scope-change-v1.pdf
Retest acceptance criteria	2.1	04 Nov	Review	escalation-plan-v2.pdf

6 of 6 records

Rules of engagementControlled documents · CD-18662

Review

Version1.0

Effective date30 Oct

Documentrules-of-engagement-v2.pdf

Example screen with sample data

Process

Follow findings through retest

Inspection to corrective closure ships ready to use. 2 steps need a named approval before the work moves on: Review inspection (Inspection Reviewer) and Verify effectiveness (Effectiveness Reviewer).

Drag a card to another stage, or focus it and use the arrow keys. It updates to match the stage.

Plan inspection

Assign a subject, date and person to the inspection.

Obtain revised scope approvalCA-67648 · Inspection Reviewer
Plan inspectionBy Inspection Reviewer
Complete checks

Record requirement results and evidence before review.

Obtain revised scope approvalCA-67648 · Tester
Complete checksBy Tester
Review inspection

The Inspection Reviewer decides acceptance or rejection.

Obtain revised scope approvalCA-67648 · Inspection Reviewer
Review inspectionBy Inspection Reviewer
ApprovalInspection Reviewer decides the inspection disposition.
Contain issue

Link a rejected inspection to a tracked issue.

Obtain revised scope approvalCA-67648 · Inspection Reviewer
Contain issueBy Inspection Reviewer
Implement correction

The owner records root cause and corrective work.

Obtain revised scope approvalCA-67648 · Corrective Action Owner
Implement correctionBy Corrective Action Owner
Verify effectiveness

The Effectiveness Reviewer checks the completed action.

Obtain revised scope approvalCA-67648 · Effectiveness Reviewer
Verify effectivenessBy Effectiveness Reviewer
ApprovalEffectiveness Reviewer approves effective corrective work.

Start with Finding lifecycle

Inside a record

Connect the tools your team uses

Open any corrective action to see the roles that work on it, its process stages and its approvals on one page.

1
Record details
Nonconformance, Owner and Due date.
2
Linked records
Records linked to this corrective action.
3
Who works on it
Corrective Action Owner and Effectiveness Reviewer, each with their own permissions.
4
Process stages
Implement correction and Verify effectiveness, with the role that acts.
5
Approvals
Review inspection and Verify effectiveness, with who decides.

Corrections for effectiveness reviewObtain revised scope approval

Penetration Test Management · Corrective actions

Obtain revised scope approval

Missing evidence for login check · Effectiveness review

Log activity

Record details

NonconformanceMissing evidence for login check

OwnerJonah Mercer

Due date03 Nov

Who works on it

Corrective Action OwnerManage corrective actions
Effectiveness ReviewerManage corrective actions, Nonconformances

Process stages

Implement correctionCorrective Action Owner
Verify effectivenessEffectiveness Reviewer

Approvals

Review inspectionInspection Reviewer
Approved
Verify effectivenessEffectiveness Reviewer
Waiting

Example screen with sample data

Approvals

Put review decisions with the right person

OverviewApprovals

Penetration Test Management · Overview

Approvals

Signed in as Inspection Reviewer

Waiting for you

4 To review1 Overdue2 Decided todayOnly mine

0 selectedApproveReturn

CA-67648Obtain revised scope approval
Missing evidence for login checkRequested by Jonah Mercer
Effectiveness review1dActions
CA-34109Restrict scans to listed hosts
Proof file absent from reportRequested by Jonah Mercer
Effectiveness review2dActions
CA-13767Attach redacted request trace
Proof file absent from reportRequested by Leila Haddad
Effectiveness review4dActions
CA-63290Repeat access-control retest
Unapproved target in scan listRequested by Maya Sen
Effectiveness review3dActions

Who approves what

	Decision	Approver
	Review inspectionThe Inspection Reviewer decides acceptance or rejection.	Inspection Reviewer
	Verify effectivenessThe Effectiveness Reviewer checks the completed action.	Effectiveness Reviewer
	Approve Inspections	Inspection Reviewer
	Approve corrective actions	Effectiveness Reviewer

4 approval rules · set per role in Proto

Example screen with sample data

Who can approve what

Roles

A workspace for each role

Everyone opens Penetration Test Management to the work that is theirs. Pick a role to see what it starts with.

Admin

Configure access and reference records.

Manage Users, People, engagement scopes, controlled documents
View security findings, Inspections, Nonconformances

Auditor

Plan audits and record requirement findings.

This is the first screen this role sees.

OverviewDocuments under review

Documents under review

Controlled documents · Auditor

Title	Version	Effective date	Status	Document
Rules of engagement	1.0	30 Oct	Review	rules-of-engagement-v2.pdf
Client authorization procedure	1.1	23 Oct	Review	evidence-standard-v1.pdf
Evidence handling standard	1.2	25 Oct	Review	retest-criteria-v3.pdf
Critical finding escalation plan	2.0	01 Nov	Review	scope-change-v1.pdf
Retest acceptance criteria	2.1	04 Nov	Review	escalation-plan-v2.pdf

6 of 6 records

Example screen with sample data

Roles and permissions

Reports

See what needs a decision

Review finding status, inspection exceptions and corrective due dates.

Overview

Penetration Test Management · Overview

Penetration Test Management dashboard

This quarter

Nonconformances in view

Minor

Major

Critical

Corrective actions by status

How far records got this quarter

Stage	Reached	Step
Planned	33
Approved	10	30%
Implementing	2	20%
Effectiveness review	1	50%

Number of corrective actions by status

Sample counts per stage

200

-60Planned

20Approved

20Implementing

-30Effectiveness review

-50Closed

Example screen with sample data

All reports and dashboards

Who it's for

Fit the team's testing context

See how Penetration Test Management fits your kind of team.

Internal security teams

Use authorized scopes and evidence for internal security teams.

Security consultancies

Use authorized scopes and evidence for security consultancies.

Service operators

Use authorized scopes and evidence for service operators.

Controls

Keep evidence with its outcome

Each stage of inspection to corrective closure names the role that acts and the status it records, so a change is never anonymous.

OverviewInspection to corrective closure

Penetration Test Management · Process

Inspection to corrective closure

Each stage, the role that acts and the status it records

Process stages

Approval steps

Roles involved

Tables touched

Remediate finding

Security Lead

StatusOpen → Remediating

RecordsSecurity findings

Retest finding

Security Lead, Tester

StatusRemediating → Retest

RecordsSecurity findings

Complete checks

Tester

StatusIn progress → Review

RecordsInspection checks, Inspections

Inspection to corrective closure

Start
Remediate findingOpen → Remediating
Security findings
Step
Retest findingRemediating → Retest
Security findings
Step
Complete checksIn progress → Review
Inspection checks
Approval
Review inspectionReview → Accepted
Inspections
Step
Contain issueOpen → Containment
Nonconformances

Example screen with sample data

See each stage in detail

AI agent

Prepare the next handoff with Proto

Use Proto to prepare records, views and review steps with your team.

It can

Security Lead: Prepare an engagement scope with client targets, dates and an authorization document for human review.
Tester: Organize a finding under the correct engagement and collect its affected asset, severity and evidence.
Inspection Reviewer: Surface the requirement checks and their results before the disposition decision.
Corrective Action Owner: Gather the root cause, action, due date and linked issue for the independent effectiveness decision.

Stays with a person

Proto can prepare records and explain the next handoff.
The named person confirms authorization and decides inspection disposition and corrective effectiveness.
Confirm the decision against the attached evidence and record it under the responsible role.

Set up an agent

agent · penetration test management

Show the engagement scope for this client, then list the findings marked Retest with their affected assets and evidence. Prepare the inspection review record; leave the decision to the reviewer.

Proto can prepare records and explain the next handoff.

Integrations

Connects to the tools you use

Set up connections through ERP.AI and Proto workflows, with every change logged.

Penetration Test Management
Testing tools
Client communication
Issue tracking
Document storage

Data model

Your data, in tables you can change

Every record lives in a table you can see, extend and export. Add fields or whole tables in Proto.

Browse all 12 tables

12tables

Engagement scopes1
Security findings2
Inspections and checks3
Disposition and corrective actions5
Audits and findings3
Controlled documents3

Implementation

Roll out one team at a time

Start with one team and one process, then add the rest once the basics are running.

Choose the pilot
Select one authorized engagement, a named security lead and tester, and a testing window with clear targets.
Prepare people
Set up access for the security lead, tester, inspection reviewer, corrective owner, effectiveness reviewer and auditor according to their work.
Load source records
Enter the engagement scope and authorization document; prepare People and any inspection or audit records used in the pilot.
Rehearse finding work
Record a finding, retain evidence, move it through remediation and retest, and review its final status.
Rehearse quality review
Record a failed inspection check, review the inspection, link an issue and assess the completed corrective action independently.

Read the implementation plan

Pricing

$0per user

The base account and everyday work in the ERP.AI app are free, for every user.

No per-user or per-seat fees
Viewing, editing, approving and exporting records in the app is free
Pay only for machine work: API calls, imports, workflows and AI agents
Prepaid credits from $5. Purchased credits never expire

Pricing details

Machine work rate card Included per $1 of credit

Machine work rate card
Usage	Per $1
Record reads (list, filter, get)	20,000
Search or aggregate queries	4,000
Record writes	4,000
Imported or synced records	200,000
Workflow runs	2,000
AI agent runs	2,000
Scheduled jobs or webhooks	20,000
File uploads (MB)	2,000
CSV or PDF exports	100

FAQ

Questions, answered

Scope, rollout and pricing for Penetration Test Management.

All questions

How do I get started?

Click Get started, then use Proto to configure Penetration Test Management for your business. Begin with one authorized engagement, a named tester and security lead, and a finding that can be followed through retest.

What does an engagement scope contain?

It records the client name, authorized targets, start and end dates, and authorization document. Review these details before testing work begins.

How is a finding tied to its authorization?

Each security finding links to an engagement scope. It also records the affected asset, severity, evidence and current status.

How do we tell remediation from retesting?

The finding status distinguishes Open, Remediating and Retest. Closed and accepted risk are separate recorded outcomes.

Can a tester record check evidence?

Yes. An inspection check holds a requirement, observation, result and evidence attachment under its inspection.

Who decides an inspection outcome?

The inspection reviewer checks the required results and chooses whether the scope is accepted or rejected. Failed evidence remains with the check.

What follows a rejected inspection?

A linked nonconformance records severity and disposition work. Corrective actions link to that issue and have an owner, due date and effectiveness state.

How is a correction closed?

An independent effectiveness reviewer checks the response. The issue closes after its linked actions are accepted.

What do audit records cover?

An audit records scope, auditor and reporting status. Its findings record requirement, severity, owner and due date.

How do people acknowledge a document?

A training acknowledgment links a person to a controlled document and records the acknowledgment date. Keep the intended version clear.

Set up Penetration Test Management your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

Start now Download Proto

How to get started

Find your application

Keep authorized targets and finding outcomes together.

Corrections for effectiveness review

Work from the authorized record

Engagement scopes

Engagement windows

Security findings

Findings for retest

Inspections and checks

My inspections

Disposition and corrective actions

Inspections awaiting review

Audits and findings

Audit findings due

Controlled documents

Documents under review

Follow findings through retest

Plan inspection

Complete checks

Review inspection

Contain issue

Implement correction

Verify effectiveness

Connect the tools your team uses

Obtain revised scope approval

Who works on it

Process stages

Approvals

Put review decisions with the right person

Approvals

Waiting for you

Who approves what

A workspace for each role

Admin

Security Lead

Open security findings

Tester

Open security findings

Inspection Reviewer

Nonconformance queue

Corrective Action Owner

Nonconformance queue

Effectiveness Reviewer

Nonconformance queue

Auditor

Documents under review

See what needs a decision

Penetration Test Management dashboard

Corrective actions by status

Number of corrective actions by status

Fit the team's testing context

Internal security teams

Security consultancies

Service operators

Keep evidence with its outcome

Inspection to corrective closure

Prepare the next handoff with Proto

It can

Stays with a person

Connects to the tools you use

Your data, in tables you can change

Roll out one team at a time

Choose the pilot

Prepare people

Load source records

Rehearse finding work

Rehearse quality review

Machine work rate card Included per $1 of credit

Questions, answered

More IT Service systems

IT Service Management

ITSM for Retail

Network Inventory Management

ITSM for Healthcare and Hospitals

DevOps Dashboard

Server Monitoring

Set up Penetration Test Management your way.

Your Privacy, Your Choice

Manage Your Cookie Preferences