Write Better Pentest Reports
The pentest reporting and management platform.
The platform
Built for Security Teams by Pentesters
Six core capabilities, each with its own deep dive.
5
export formats
12+
AI provider types
3.1 & 4.0
CVSS scoring
160+
REST endpoints
40+
MCP tools
6
SSO provider types
How it works
One platform, a complete workflow
From planning to client delivery, everything happens in Vulnotes: no insecure report channels, no file ping-pong, no version chaos.
- Plan
Schedule engagements on the team calendar and start reports from planned tests.
- Design
Build branded report templates in your browser. No Word Templating
- Write
Document findings, correct mistakes and improve with AI assistance.
- Review
Snapshots, threaded comments, change requests and approval tracking.
- Deliver
Export DOCX, PDF, XLSX, JSON or encrypted ZIP. White-label ready.
Deployment
Run Vulnotes your way
Cloud in minutes, self-hosted on your own infrastructure at the same price, or fully air-gapped for highly sensitive environments.
Self-hosted in one command
Self-hosting is included in every plan at the same price as cloud. Install with the CLI and keep your reports on your own servers.
bash
curl -fsSL https://raw.githubusercontent.com/vulnotes/vulnotes-cli/master/install.sh | bash
./vulnotes init --token <provisioning-token>
./vulnotes startAir-gapped and isolated environments
For highly sensitive work, Vulnotes also ships as an Air-Gap Server for networks with zero connectivity, and as a standalone Workstation app for a single isolated machine. Licensing and updates work fully offline, and both editions are available through sales@vulnotes.com.
Frequently Asked Questions
Everything you need to know about Vulnotes
No. Self-hosting is included in every plan at the same price as cloud, with a one-command Docker install on your own infrastructure. Learn more about self-hosting.
Before any data reaches an external provider, company names, IP addresses, domain names and URLs, email addresses and person names are replaced with placeholders and restored in the response. You can bring your own model, run fully local with Ollama, or disable AI entirely. See how anonymization works.
Everything: unlimited reports, five export formats (PDF, DOCX, XLSX, JSON, encrypted ZIP), real-time collaboration and review, SSO and 2FA, the REST API and MCP server, 1M Vulnotes AI tokens per user per month, and self-hosting. See the full pricing breakdown.
Yes. Beyond standard self-hosting, an Air-Gap Server edition runs on networks with zero connectivity, and an Air-Gap Workstation edition runs the whole platform as a standalone app on one isolated machine. Licensing and updates work fully offline; contact sales@vulnotes.com. Learn about the air-gapped editions.
Yes. Design branded report layouts in your browser with the drag-and-drop template builder: LiquidJS variables, charts, custom fonts and linked translations. No Word hacking. Explore the template builder.
Yes. Everything in the UI is scriptable: a REST API, a Python SDK, webhooks and an MCP server, so you can write and export pentest reports from Claude or any MCP client. Explore API and MCP automation.
Still have questions?
Contact our team