Platform Features

Full-stack coverage in one platform: 24+ external recon modules and 18+ internal modules, web application and API testing across the OWASP Top 10 and API Top 10 (REST and GraphQL), identity testing including Active Directory and M365, 800+ automated cloud checks across AWS, Azure, GCP and M365, and agentless Kubernetes auditing. Pick the scope you care about from the solutions library, or read how the phases fit together in our methodology.

Once a finding is confirmed, the strategy engine selects the technique most likely to prove it and executes that attempt under per-tenant Rules of Engagement. Scope enforcement stops any activity against assets you have not authorised, and chained pipelines can show how one weak credential becomes a pivot deeper into the network. Each step carries its own evidence into the report, so prioritisation is based on proof rather than a severity score alone. See attack path validation.

PentestOps AI is self-hosted by default. It runs on infrastructure Extranet Systems operates, so findings, evidence and scan data are not handed to a third-party model provider. External model providers can be enabled per tenant if you prefer, entirely at your discretion. The AI handles vulnerability analysis, context-aware risk scoring, attack chain prediction, business impact analysis, executive report drafting and per-finding remediation guidance. More detail on AI penetration testing.

No. Cloud posture auditing runs from read-only credentials you issue for AWS, Azure, GCP or M365, and covers configuration, IAM, storage and network checks against provider baselines and CIS Benchmarks. Kubernetes auditing is fully agentless via a customer-supplied read-only kubeconfig, with no permanent agent and no DaemonSet to install: an API posture review runs on every cluster and node-level CIS checks run as a short-lived, auto-cleaned in-cluster job. See Kubernetes security testing.

Continuous Monitoring is agentless External Attack Surface Management. It re-checks your public footprint between scheduled scans, tracks drift through a full change ledger, and raises real-time alerts for new or missing assets and unauthorised change, with HMAC-signed log shipping for your own pipeline. A scan is a deep assessment at a point in time; monitoring is the always-on layer between those scans. It is an Enterprise capability, described further under EASM.

Reports pair an executive summary with technical detail, captured evidence and prioritised remediation, and map findings to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes. Multiple formats are available including PDF, CSV and JSON/API, and drift, asset-change and incident events can be pushed to email or a Slack-compatible webhook so findings reach the systems your team already watches.

No, capability scales with the tier. Starter covers external, internal, web application and API testing with basic compliance reporting. Professional adds cloud auditing, AI-guided remediation, full compliance reporting, scheduled scans, scan comparison, integrations and team management on an isolated workload. Enterprise adds email and M365 auditing, advanced exploitation, continuous monitoring, SSO, custom retention and data-residency options, and an on-premise deployment option. Current inclusions are on the pricing page.

A scanner tells you a weakness may exist. PentestOps confirms whether it is genuinely exploitable in your environment, captures the evidence, and shows the chain an attacker would follow, then hands your team validated remediation steps rather than a raw severity list. Prioritisation uses CVSS v3.1 alongside exploit availability and CISA KEV status so the queue reflects real-world risk. The comparison page sets out where we sit against validation platforms, scanners and human-led services.