CipherProof Get started

Turn scanner output into a pentest report your client can use.

Import Burp, ZAP and Nessus results, throw out the false positives, rate what is left with CVSS 3.1, and export a finished PDF or Word report.

Get started, it's free See what it does

The free plan includes one project. No credit card.

CipherProof / Findings
The CipherProof Findings screen: a list of findings by severity and the open finding with its CVSS rating.

Imports

Burp SuiteOWASP ZAPNessus

Exports

PDFWord

Everything between the scan and the signed report.

One workspace for the findings, the evidence, the rating and the document your client receives.

  • A library of findings

    30 written vulnerability types with CWE, impact, fix and a starting CVSS vector. Rewrite any of it for the engagement.

    Replaces copy-pasting from old reports

  • CVSS 3.1 that matches

    Pick the metrics and see the score. It is calculated on the server from the vector, so the two never disagree.

    Replaces a separate calculator tab

  • Evidence editor

    Paste screenshots, cover sensitive data and mark what matters before the picture enters the report.

    Replaces editing images by hand

  • Scanner triage Pro

    Results are grouped by kind of issue. Mark a kind as a false positive once and it is remembered for the next import.

    Replaces sorting a 200-row export

  • Retest tracking

    Mark each finding open, fixed, verified or risk accepted. Once a retest starts, the report gets a status section.

    Replaces a retest spreadsheet

  • PDF and Word reports

    Six templates with contents, executive summary and page numbers in place. Word export is part of Pro.

    Replaces layout work in Word

A scanner counts places. You decide what is real.

One Burp scan of a test application gave 231 results. CipherProof grouped them into 12 kinds of issue. You mark each kind as real, a false positive or not relevant, and only the real ones are written up.

Each bright square is one kind of issue. The rest are the same issue in other places.

231 → 12results became kinds of issue to decide

A score that always matches its vector.

Change a metric and the rating follows. In CipherProof the score is calculated on the server from the vector, so a report never shows a number that does not match it.

  • The same CVSS 3.1 formula as this card
  • A changed rating needs a fresh approval
  • Until then, the report marks it as a draft
F-03

Stored cross-site scripting

Attack vector
Complexity
Privileges
User interaction
Scope
Confidentiality
Integrity
Availability
6.1 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

From scan to report in three steps

  1. Import and triage

    Drop in a Burp, ZAP or Nessus file. Results are grouped by kind of issue and low-value ones are hidden. Mark a kind as a false positive once and CipherProof remembers it for your next projects.

    The CipherProof Inbox: scanner results grouped into 12 kinds of issue, with a cross-site scripting result open for review.

  2. Complete what the scanner cannot

    Fill in impact and remediation, add your own observations and screenshots, and check the CVSS vector. Nothing reaches the report until you promote it, and a rating that started from a scanner always waits for your approval.

    The Findings screen: a list of findings by severity and the open finding with its CVSS rating.

  3. Preview and export

    See the real PDF before you export it, with contents, executive summary and page numbers already in place. Export it as a PDF, or as a Word file on the Pro plan.

    The export screen with a preview of the report and a checklist of what is ready.

Six report templates, in your colours

Pick a template, set your accent colour and logo, and every report looks like it came from your firm. Pro reports carry your company name in the footer.

  • Executive template cover
    Executive
  • Classic template cover
    Classic
  • Terminal template cover
    Terminal
  • Minimal template cover
    Minimal
  • Bold template cover
    Bold
  • Blueprint template cover
    Blueprint

From the blog

Practical writing on pentest reports, and plain updates on what we build. All posts

Practice

Most scanner results are not findings

A scanner gives you a list; a client needs a story. How to go from hundreds of raw results to a handful of findings you can defend.

  • Triage
  • Scanners
  • CVSS
  • Writing
By CipherProof4 min read

Write your next report in CipherProof.

The free plan includes one project. No credit card.

Get started, it's free