Cyver Core alternative
Vulnotes vs Cyver CoreCo-editing, AI and self-hosting from day one.
Looking for a Cyver Core alternative? Vulnotes gives your pentest team a visual report builder with live preview, import of your existing Word report, real-time co-editing and snapshot-based review, with DOCX, PDF, XLSX and JSON exports. Built-in EU-hosted AI, the MCP server and self-hosting are included in one plan at €48 per user per month, with a white-label client portal available as an add-on. Cyver Core is a pentest-as-a-service platform with tiered plans; here is how the two compare.
Cyver Core information checked on 29 October 2026 against its public documentation and pricing. Cyver Core is a trademark of Cyver BV.
Vulnotes vs Cyver Core
- Co-editing from the first user
- Engagement planning included
- EU-hosted AI or your own model
Vulnotes or Cyver Core: which one fits your team?
Vulnotes
Choose Vulnotes if…
- You want to design the report layout visually, preview the paginated output while writing, and start from your existing Word report or template.
- Your testers co-edit the same report and you want real-time collaboration and a snapshot-based review from the first user, without moving to a higher tier.
- You want one per-user price with all core features included, the same for SaaS and self-hosted, on monthly or annual billing.
- You need to run fully offline, on an air-gapped server or a single isolated workstation.
- You want built-in EU-hosted AI or your own provider, including a local model, with recognized sensitive data anonymized before each request.
Cyver Core
Choose Cyver Core if…
- Your business is built on pentest-as-a-service delivery, with the client portal at the centre.
- You want a client portal included in the base plan.
- Your team prefers token-based report templates.
Vulnotes vs Cyver Core: feature comparison
| Capability | Vulnotes | Cyver Core |
|---|---|---|
| Pricing | VulnotesOne plan, €48 per user per month, monthly or annual billing, same price for SaaS and self-hosted | Cyver CoreTiered team plans from €249 per month (annual billing); Enterprise by quote |
| Plan limits | VulnotesPriced per user; all platform features in one plan; no limit on reports or projects | Cyver CoreFeatures and user counts by tier |
| Report editor | VulnotesCollaborative rich-text editor with Markdown syntax converted as you type and live preview of the paginated report | Cyver CoreMarkdown and rich-text editors |
| Report templates | VulnotesDrag-and-drop visual template builder with DOCX/DOTX import | Cyver CoreConfigurable templates with branding |
| Real-time co-editing | VulnotesIncluded, with live cursors and presence | Cyver CoreFrom the Professional plan |
| Review | VulnotesReview workflow with automatic snapshot, change view, annotations and per-item revert | Cyver CoreReview comments and versioning |
| Exports | VulnotesPDF, DOCX, XLSX, JSON, password-protected ZIP; all included | Cyver CorePDF and Word; HTML and password-protected PDF on Enterprise only |
| Client portal | VulnotesWhite-label add-on: €10 per Vulnotes user/month, 4 client companies per user, unlimited client users, remediation tracking, retest requests | Cyver CoreWhite-label portal included; custom domain an add-on on Team; client roles and Jira connector on Enterprise only |
| Import and automation | VulnotesPwnDoc importer, standardized JSON import, REST API, Python SDK and webhooks; included | Cyver CoreImports and REST API; webhooks and Jira/Azure DevOps connector on Enterprise only |
| Scoring | VulnotesCVSS 3.1, CVSS 4.0 or custom score per vulnerability template | Cyver CoreCVSS or custom scoring |
| Deployment | VulnotesSaaS (Europe by default, other regions on request) or self-hosted Docker at the same price; Air-Gap Server and Air-Gap Workstation by quote | Cyver CoreCloud; on-prem from Professional on annual plans; air-gapped as an Enterprise add-on |
| AI | VulnotesEU-hosted Vulnotes AI (1M tokens/user/month) or your own provider, including Ollama; anonymization before each request | Cyver CoreGenAI Copilot on Azure OpenAI; Advanced Copilot on Enterprise only |
| API and MCP | VulnotesREST API, webhooks and MCP server on the single plan | Cyver CoreREST API; MCP from Professional; webhooks and client API on Enterprise only |
| Single sign-on | VulnotesGoogle, Microsoft Entra ID and LDAP; 2FA; included | Cyver CoreGoogle/Microsoft SSO (needs the custom domain add-on on Team); SAML2 on Enterprise only |
| Planning | VulnotesEngagement calendar with availability and conflict detection; included | Cyver CorePlanning, scheduling and timesheets on Enterprise only |
Cyver Core pricing vs Vulnotes: all core features in one per-user plan
Vulnotes charges €48 per user per month, billed monthly or annually, at the same price for the SaaS and for a self-hosted install. Real-time co-editing, snapshot review, the visual template builder, built-in AI, the REST API and the MCP server are part of that single plan, with no limit on reports or projects. The white-label Client Portal is an optional add-on at €10 per user per month, so teams that deliver reports by export only do not pay for it.
Cyver Core prices by team tier, from €249 per month on annual billing, with features such as real-time collaboration, the MCP server and on-prem deployment listed from its Professional plan, and SAML2 SSO, webhooks and planning on Enterprise only. With Vulnotes, every tester gets the same features from the first seat, and the bill grows one user at a time.
Pentest report templates: a visual builder with live preview
The Vulnotes template builder is a drag-and-drop designer that runs in the browser: you place pages, headers, footers, tables, charts and finding loops, and see the paginated report as you write. An existing Word report or template (.docx or .dotx) can be imported and converted into an editable layout, after which client-specific values are replaced with variables. The same design renders to PDF and native DOCX, with XLSX, JSON and password-protected ZIP exports alongside.
Cyver Core uses Markdown and rich-text editors with configurable, token-based templates. In Vulnotes, the people who write the report can also adjust its layout and see the result immediately.
Real-time co-editing and snapshot review, included from the first user
Several testers can write the same Vulnotes report at the same time, with live cursors and presence. When the draft is ready, the review workflow freezes a snapshot, shows every change since it was taken, supports annotations on the rendered pages and lets reviewers revert individual items. Engagement planning with availability and conflict detection, kill chains, retests and a reusable multilingual vulnerability library are part of the same plan.
Cyver lists review comments and versioning on all plans, with real-time collaborative editing from Professional. On Vulnotes, co-editing is there for a team of two as much as for a team of twenty.
Client portal: white-label delivery when your clients need it
Cyver Core is built around pentest-as-a-service delivery and includes its white-label client portal in its plans, with features such as client roles and the ticketing connector on Enterprise only.
The Vulnotes Client Portal gives clients a white-label space where they follow findings through remediation, request retests and new pentests, download deliverables, see statistics and push findings to their own Jira, GitHub Issues or Azure Boards. Each Vulnotes user covers four client companies with unlimited client users, for €10 per user per month, on SaaS or self-hosted.
Self-hosted or cloud in your region, at the same price, plus air-gap editions
Cyver Core is cloud-hosted, with on-prem deployment listed from its Professional plan on annual billing and air-gapped on-prem as an Enterprise add-on.
Vulnotes runs as a SaaS, hosted in Europe by default or in another region on request, or self-hosted with a Docker install, at the same per-user price and on monthly or annual billing. For disconnected environments there are two editions: Air-Gap Server for networks with no connectivity, and Air-Gap Workstation, a standalone desktop app for one isolated machine, both with offline licensing and signed update bundles.
AI for pentest reports: EU-hosted, your own provider or a local model
Cyver Core's GenAI Copilot runs on Azure OpenAI, with the Advanced Copilot on Enterprise only.
Vulnotes ships its own EU-hosted AI with 1M tokens per user per month, or lets an administrator connect one of 12 provider types, including local models through Ollama and any OpenAI-compatible endpoint. Before each request, recognized client names, person names, emails, IP addresses, hostnames, scope entries and credential patterns are anonymized and restored in the response. Teams that want no text to leave their own infrastructure can use a fully local provider, and the MCP server is part of the single plan.
How to migrate from Cyver Core to Vulnotes
Moving from Cyver Core uses the Vulnotes DOCX template import for your report layout, the standardized JSON import for your finding library, and the REST API, Python SDK or MCP server for automation.
- 1
Rebuild your report layout from a Word export
Export a representative report from Cyver Core to Word and import the .docx in Templates > New Template. Vulnotes converts headings, tables, lists, charts and images into an editable layout; replace client names, dates and findings with variables and finding loops.
- 2
Define your vulnerability templates
Recreate your finding fields (description, impact, remediation, references, evidence) and choose CVSS 3.1, CVSS 4.0 or a custom score for each vulnerability template before importing any findings.
- 3
Bring over your finding library
Export your findings from Cyver Core, convert them to the Vulnotes standardized JSON import format with a short script, then import them from Administration > Settings > Integrations.
- 4
Automate with the API, SDK or MCP server
Push findings from your own scripts through the standardized JSON import, the REST API or the Python SDK, or work from an AI client through the MCP server.
- 5
Move clients over gradually
Enable the Client Portal add-on and invite each client company when its next engagement starts.
Common questions
What is the best Cyver Core alternative for pentest reporting?
It depends on how your team works. If the report is at the centre, Vulnotes gives you a visual template builder with live preview, DOCX/DOTX import, real-time co-editing, snapshot review and DOCX, PDF, XLSX and JSON exports, with AI, the MCP server and self-hosting included at €48 per user per month.
How much does Cyver Core cost?
Cyver Core lists tiered team plans from €249 per month on annual billing, with Enterprise by quote. Vulnotes is €48 per user per month on monthly or annual billing, the same for SaaS and self-hosted, with a 14-day trial when you schedule a demo.
Cyver Core vs Vulnotes: which is better for pentest reports?
Cyver Core is built around pentest-as-a-service delivery, with Markdown or rich-text editing and token-based templates. Vulnotes is built around the report itself: a visual builder with live paginated preview, real-time co-editing for every user and a review workflow with snapshots, change view and annotations.
How do I migrate from Cyver Core to Vulnotes?
Export a representative Cyver report to Word and import the .docx into the Vulnotes template builder, then replace client-specific values with variables and finding loops. Bring your finding library over through the standardized JSON import, and enable the Client Portal add-on as each client's next engagement starts.
Does Vulnotes have a client portal like Cyver Core?
Yes, as an add-on at €10 per Vulnotes user per month, with four client companies per user and unlimited client users. Clients follow findings through remediation, request retests and pentests, download reports and sync findings to Jira, GitHub Issues or Azure Boards.
Can Cyver Core be self-hosted?
Cyver lists on-prem deployment from its Professional plan on annual billing, with air-gapped on-prem as an Enterprise add-on. Vulnotes includes self-hosting at the same €48 per user per month as its SaaS, on monthly or annual billing, and offers Air-Gap Server and Air-Gap Workstation editions for offline environments.
Can I use my own AI provider or a local model instead of Cyver's Copilot?
Cyver states that its GenAI Copilot runs on Azure OpenAI. Vulnotes includes its own EU-hosted AI with 1M tokens per user per month and supports 12 AI provider types, including local models through Ollama and any OpenAI-compatible endpoint, with recognized sensitive data anonymized before each request.
See your own report
in Vulnotes.
Set up in minutes. Write, review and deliver your next pentest report in Vulnotes.
