Introducing CipherProof: pentest reports without the formatting weekend

It is Friday, six in the evening. The testing is finished. The scan found 231 results, your notes are spread over four files, and the report is due on Monday morning. You already know what the weekend looks like: the same descriptions pasted into a Word template, a table of contents that will not update, screenshots that refuse to line up.

CipherProof is built for that moment. It takes your findings, and the scanner output you start from, and turns them into a finished pentest report your client can read.

What it does#

• Import and triage. Drop in a Burp, ZAP or Nessus file. Results are grouped by kind of issue, so in our example scan 231 results become 12 decisions, and low-value ones are hidden. Mark a kind as a false positive once and CipherProof remembers it for your next projects. Import is part of Pro.
• Complete what the scanner cannot. Add impact and remediation, your own observations and screenshots, and check the CVSS 3.1 vector. Nothing reaches the report until you promote it, and a rating that started from a scanner always waits for your approval.
• Preview before you export. See the real PDF, with contents, executive summary and page numbers already in place. Export it as a PDF, or as an editable Word file on Pro.
• Look like your firm. Six templates, your accent colour, your logo and company name. The brand kit is part of Pro.

What it is not#

CipherProof is not a scanner. It never touches your targets and it never tests anything for you. It also does not decide how serious a finding is: it computes the CVSS 3.1 score from the vector you choose, and you approve every rating.

Free and Pro#

The free plan includes one project and PDF export, with no credit card. Pro adds scanner import, Word export, the brand kit and up to 50 projects at once. The pricing page has the full comparison.

Your client's data#

You are handing us findings that belong to someone else, so we wrote down exactly how we treat them: where they are stored, who else touches them and how deletion works. Every account also has to use two-step sign-in. Read what happens to your client's data.

Getting started#

1. Create an account and set up two-step sign-in with an authenticator app. It takes about a minute.
2. Open the Acme sample to see a finished project, or start an empty one.
3. Import a scan (Pro), or add findings from the built-in library.
4. Approve the ratings and fill in impact and remediation.
5. Preview the report and export it.

Why "CipherProof"?#

The testing is the hard part. The report is the proof that it happened, and it should look like it. A cipher hides things; a pentest report does the opposite.

Burp Suite, OWASP ZAP and Nessus are trademarks of their owners.