Platform Features

Full-stack coverage in one platform: 24+ external recon modules and 18+ internal modules, web application and API testing across the OWASP Top 10 and API Top 10 (REST and GraphQL), identity testing including Active Directory and M365, 800+ automated cloud checks across AWS, Azure, GCP and M365, and agentless Kubernetes auditing. Pick the scope you care about from the solutions library, or read how the phases fit together in our methodology.

Once a finding is confirmed, the platform selects the technique most likely to prove it and executes that attempt under per-tenant Rules of Engagement. Scope enforcement stops any activity against assets you have not authorised, and exploit chains can show how one weak credential becomes a pivot deeper into the network. Each step carries its own evidence into the report, so prioritisation is based on proof rather than a severity score alone. See attack path validation.

PentestOps AI is self-hosted by default. It runs on infrastructure Extranet Systems operates, so findings, evidence and scan data are not handed to a third-party model provider. External model providers can be enabled per tenant if you prefer, entirely at your discretion. The AI handles vulnerability analysis, context-aware risk scoring, attack chain prediction, business impact analysis, executive report drafting and per-finding remediation guidance. More detail on AI penetration testing.

No. Cloud posture auditing runs from read-only credentials you issue for AWS, Azure, GCP or M365, and covers configuration, IAM, storage and network checks against provider baselines and CIS Benchmarks. Kubernetes auditing is fully agentless via a customer-supplied read-only kubeconfig, with no permanent agent and no DaemonSet to install: an API posture review runs on every cluster and node-level CIS checks run as a short-lived, auto-cleaned in-cluster job. See Kubernetes security testing.

Continuous Monitoring is External Attack Surface Management plus web traffic monitoring. Perimeter re-checks run on a schedule, daily by default on Professional and as often as every 15 minutes on Enterprise, re-enumerate the subdomains of your monitored domains and email you about new or reopened issues at or above your alert threshold. Traffic monitoring runs 24/7 and classifies attack traffic from your web server logs in real time as it arrives, with email alerts, a view of where attacks come from and IP blocking on your host firewall, Cloudflare or AWS WAF. A scan is a deep assessment at a point in time; monitoring is the layer that keeps watching between those scans. It is included on the Professional and Enterprise plans, together with Exposure Monitoring of your corporate email addresses, and is described further under EASM.

Reports pair an executive summary with technical detail, captured evidence and prioritised remediation, and map findings to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes. Multiple formats are available including PDF, CSV and JSON/API, and scan events and critical findings can be pushed to Slack, a webhook, Jira or GitLab when a scan completes, so findings reach the systems your team already watches.

No, capability scales with the tier. Starter covers external, internal, web application and API testing with basic compliance reporting. Professional adds cloud auditing, AI-guided remediation, full compliance reporting, scheduled scans, scan comparison, continuous monitoring with Exposure Monitoring, integrations, team management and single sign-on (SSO) on an isolated workload. Enterprise adds email and M365 auditing, CI/CD pipeline scanning, advanced exploitation, data-residency options and an on-premise deployment option. Current inclusions are on the pricing page.

A scanner tells you a weakness may exist. PentestOps confirms whether it is genuinely exploitable in your environment, captures the evidence, and shows the chain an attacker would follow, then hands your team validated remediation steps rather than a raw severity list. Prioritisation uses CVSS v3.1 alongside exploit availability and CISA KEV status so the queue reflects real-world risk. The comparison page sets out where we sit against validation platforms, scanners and human-led services.