Ghostwriter alternative
Vulnotes vs GhostwriterVisual templates, built-in AI and a client portal.
Looking for a Ghostwriter alternative? Vulnotes gives your pentest team a drag-and-drop report template builder with live preview, real-time co-editing, snapshot-based review and exports to PDF, DOCX, XLSX and JSON. Built-in EU-hosted AI anonymizes recognized sensitive data before each request, and an optional client portal lets clients track remediation and request retests. One per-user price covers SaaS or self-hosted, with air-gap editions for isolated networks. Ghostwriter, by SpecterOps, is a free, open-source platform for offensive operations that you host yourself and that generates reports from Word and PowerPoint templates written with Jinja2.
Ghostwriter information checked on 29 October 2026 against its public documentation and pricing. Ghostwriter is a trademark of SpecterOps, Inc..
Vulnotes vs Ghostwriter
- Built-in AI with anonymization
- White-label client portal
- Visual template builder
Vulnotes or Ghostwriter: which one fits your team?
Vulnotes
Choose Vulnotes if…
- You want to design report layouts visually in the browser and see the result live, instead of maintaining Jinja2 tags inside Word files.
- You already have a Word report and want to import it as a starting template, then export PDF, DOCX, XLSX and JSON from the same design.
- Your reviewers work on whole reports: a fixed snapshot, a change view against the live report, and annotations on the rendered pages.
- You want AI drafting and translation built in, with recognized client data anonymized first, or your own provider including a local model.
- You want a SaaS in the hosting region you need or the same product self-hosted or air-gapped, at one per-user price, with support from the vendor.
Ghostwriter
Choose Ghostwriter if…
- You want free, open-source software you can audit and modify.
- You run red-team engagements and want infrastructure tracking and operation logs in the same tool.
- Your team is comfortable hosting the platform and relying on community support.
Vulnotes vs Ghostwriter: feature comparison
| Capability | Vulnotes | Ghostwriter |
|---|---|---|
| Licence and price | VulnotesOne plan at €48 per user per month, billed monthly or annually, the same price for SaaS or self-hosted | GhostwriterFree and open source (BSD-3-Clause) |
| Deployment | VulnotesSaaS hosted in Europe by default, or in another region on request, self-hosted with Docker, or Air-Gap Server and Air-Gap Workstation editions | GhostwriterSelf-hosted with Docker |
| Report layout | VulnotesDrag-and-drop template builder in the browser with live preview, variables and finding loops | GhostwriterWord and PowerPoint templates with Jinja2 |
| Existing Word reports | VulnotesDOCX and DOTX import turns an existing Word report or template into an editable layout | GhostwriterTemplate files uploaded to the application |
| Starter templates | VulnotesNine report templates and three landscape presentation templates, downloadable from Vulnotes Manager | GhostwriterTwo basic templates |
| Export formats | VulnotesPDF, DOCX, XLSX, JSON and password-protected ZIP; slide decks are landscape templates exported as PDF or DOCX | GhostwriterDOCX, PPTX, XLSX and JSON |
| Collaborative editing | VulnotesReal-time co-editing of report content and findings with live cursors and presence, included in the plan | GhostwriterReal-time editor |
| Review workflow | VulnotesAssigned reviewer, automatic snapshot, change view with revert, annotations on rendered pages | GhostwriterPer-finding status |
| AI assistance | VulnotesBuilt-in EU-hosted AI with 1M tokens per user per month, or your own provider including Ollama; anonymization of recognized sensitive data before each request | GhostwriterNot documented |
| Client access | VulnotesWhite-label client portal add-on (€10 per user per month) with remediation tracking and retest requests; viewer seats at €24 per month | GhostwriterNo client portal documented |
| Engagement operations | VulnotesPlanning calendar with availability and conflict detection; kill chains that turn findings into an ordered attack narrative | GhostwriterInfrastructure tracking and operation logs |
| Findings library | VulnotesReusable multilingual vulnerability library on custom field schemas; PwnDoc and standardized JSON import | GhostwriterFindings and observations libraries |
| Scoring | VulnotesCVSS 3.1 and 4.0 calculators, or custom scoring criteria | GhostwriterCVSS v3 and v4 |
| API and integrations | VulnotesREST API with permission-scoped keys, Python SDK, MCP server, webhooks, HackerOne draft export | GhostwriterGraphQL API and integrations |
| Authentication | VulnotesMicrosoft Entra ID, Google, LDAP, two-factor authentication, role-based access | GhostwriterSSO and MFA |
| Support | VulnotesEmail support, in-app support, tickets and priority support for large teams | GhostwriterGitHub and community Slack |
Word templates without Jinja2: a visual report builder with live preview
In Vulnotes, report templates are built in the browser with a drag-and-drop builder: pages, headers and footers, tables, charts, a table of contents and finding loops, with variables and a live debugger in the report preview. The same design renders to PDF and native DOCX, and findings export to XLSX and JSON, so the preview your team checks is the deliverable your client receives.
You do not have to start from a blank page. Import an existing Word report or template (.docx or .dotx) and Vulnotes converts its text, headings, tables, charts and images into an editable layout, or start from one of the nine report templates and three presentation templates.
Ghostwriter takes a different route: the layout lives in a Word or PowerPoint file written with Jinja2 expressions, which you upload and render to an Office document. With Vulnotes, whoever maintains your templates can change the report design visually, without Jinja2 and without opening Word.
Collaboration and review: real-time co-editing plus snapshot-based review
Vulnotes includes real-time co-editing of report content and findings, with live cursors and per-field presence, so several testers can write the same report at once. Ghostwriter also offers a real-time editor; it tracks review as a status on each finding.
Vulnotes reviews the whole report. Setting a report to Waiting for Review creates a snapshot; the reviewer compares it with the live report side by side or in a change view that marks added, removed and modified content, including severity changes, and can revert individual items. Annotations are drawn on the rendered pages, with replies and resolve or reopen states.
For a pentest team, that means reviewers see exactly what changed since review started, comment where the client will read the text, and sign off on the deliverable rather than on fields one by one.
AI for pentest reports: built in, EU-hosted, with anonymization
Vulnotes includes AI in the editor: drafting findings and report sections, rewriting, translation and finding generation from screenshots. The built-in EU-hosted service comes with 1M tokens per user per month, and you can switch to your own provider among 12 provider types, including OpenAI-compatible endpoints and local models through Ollama.
Before each request, Vulnotes replaces recognized client names, person names, emails, IP addresses, hostnames, scope entries and credential patterns with placeholders, and restores them in the response. An MCP server also lets your own assistant work with your Vulnotes data.
Ghostwriter's documentation and changelog do not describe AI features. With Vulnotes, your team gets AI help on every report without building its own tooling, and keeps control over what leaves your environment.
A client portal for remediation and retests
Ghostwriter produces report files that you send to the client, and no client portal is documented. Vulnotes adds an optional white-label client portal at €10 per Vulnotes user per month, available on SaaS and self-hosted.
In the portal, client users see the reports and findings shared with their company, track remediation, request retests and sync findings to Jira, GitHub Issues or Azure Boards. Read-only viewer seats are also available at €24 per viewer per month. Your team delivers a report and keeps the remediation conversation in one place.
Engagement planning, kill chains and retests
Vulnotes plans engagements on a calendar that shows tester availability and detects scheduling conflicts. During the test, kill chains turn flagged findings into an ordered attack narrative in the report, and retests record whether each finding is fixed or still vulnerable.
Ghostwriter focuses on red-team operations, with infrastructure tracking and operation logs. Vulnotes keeps the focus on planning, writing and delivering pentest reports, from the first calendar slot to the retest.
Ghostwriter pricing vs Vulnotes: self-hosted or SaaS at one price
Ghostwriter is free and open source. You host it yourself with Docker, and help comes from its wiki, GitHub issues and the community Slack; SpecterOps does not document a hosted version or a paid support plan.
Vulnotes costs €48 per user per month, billed monthly or annually, whether you use the SaaS or self-host it with Docker, with a 14-day trial when you schedule a demo. Air-Gap Server and Air-Gap Workstation editions cover networks with no connectivity, with offline activation and signed update bundles.
Support comes directly from the Vulnotes team, by email, in the app or through tickets. Your team can hand hosting, updates and backups to Vulnotes, or keep everything in-house at the same price.
How to migrate from Ghostwriter to Vulnotes
A move from Ghostwriter uses the Vulnotes DOCX template import for layouts, the standardized JSON import for clients and findings, and the REST API, Python SDK or MCP server for automation.
- 1
Import your Word template
Download your DOCX template from Ghostwriter and import it from Templates > New Template > Import JSON or DOCX. Text, headings, tables, charts and images become an editable layout. Replace the Jinja2 tags with Vulnotes variables and finding loops, then check each page in preview.
- 2
Recreate your finding fields
Define a vulnerability template that mirrors your finding fields, such as description, impact, mitigation, replication steps and references, and add a CVSS field set to 3.1 or 4.0.
- 3
Move the findings library and clients
Export findings and clients from Ghostwriter through its API or an existing CSV source, and convert them to the documented Vulnotes standardized JSON import (clients, vulnerability templates, vulnerabilities). Rich text is imported as HTML.
- 4
Reconnect your automation
Move your scripts to the Vulnotes REST API with permission-scoped keys, the Python SDK, webhooks or the MCP server.
- 5
Run one engagement end to end
Write one report in Vulnotes, take it through review, and compare the PDF or DOCX with your current output before moving the rest of the team.
Common questions
What is the best Ghostwriter alternative?
It depends on what you need beyond Ghostwriter. If your team wants to design report templates visually, review whole reports on snapshots, use built-in AI and give clients a portal, Vulnotes covers all of that in one product, as SaaS or self-hosted at the same per-user price.
Is Ghostwriter free?
Yes. Ghostwriter is open source under the BSD-3-Clause licence, and you host and maintain it yourself, with community support. Vulnotes costs €48 per user per month, the same price for the SaaS or self-hosting, includes vendor support, and comes with a 14-day trial when you schedule a demo.
Ghostwriter vs Vulnotes: which is better for pentest reports?
Ghostwriter suits teams that want a free, open-source tool for red-team operations and are comfortable writing Jinja2 Word templates. Vulnotes suits teams that want a visual template builder with live preview, real-time co-editing, snapshot-based review, PDF, DOCX, XLSX and JSON exports, built-in AI and a client portal option.
How do I migrate from Ghostwriter to Vulnotes?
Import your Word template with the Vulnotes DOCX import, recreate your finding fields as a vulnerability template, and bring clients and findings across with the standardized JSON import. Your automation moves to the Vulnotes REST API, Python SDK or MCP server.
Can I import my Ghostwriter Word templates into Vulnotes?
Yes. Vulnotes imports .docx and .dotx files and converts text, headings, tables, charts and images into an editable layout. You replace the Jinja2 expressions with Vulnotes variables and finding loops in the visual builder and check the result in the live preview.
Does Ghostwriter have AI features?
Ghostwriter's documentation and changelog do not describe AI features. Vulnotes includes AI drafting, translation and screenshot analysis with a built-in EU-hosted service, or your own provider including a local model, and anonymizes recognized sensitive data before each request.
Does Ghostwriter have a client portal?
No client portal is documented for Ghostwriter; reports are delivered as files. Vulnotes offers a white-label client portal add-on at €10 per user per month, where clients track remediation, request retests and sync findings to Jira, GitHub Issues or Azure Boards.
Can Vulnotes be self-hosted like Ghostwriter?
Yes. Vulnotes runs self-hosted with Docker at the same €48 per user per month as the SaaS. For networks with no internet access, the Air-Gap Server and Air-Gap Workstation editions provide offline activation and signed update bundles.
See your own report
in Vulnotes.
Set up in minutes. Write, review and deliver your next pentest report in Vulnotes.
