Everything between the scan and the signed report.
Features marked Pro need the Pro plan. Everything else is free.
Findings
A library of 30 written vulnerability types
Each one comes with a CWE, a description, the impact, the fix and a starting CVSS vector. You rewrite any of it for the engagement, and the text can never be left empty.
CVSS 3.1 that always matches its vector
Pick the metrics and see the score, the rating and the reasons. The score is calculated on the server, so it cannot drift from the vector. Change a rating and it needs a fresh approval; until then the report marks it as a draft.
Your own library
Save a finding you wrote and reuse it in the next project. The free plan keeps 5 of your own entries; Pro has no limit.
Order, bulk actions and undo
Sort findings by severity or drag them into your own order, and the report follows. Approve, change status or delete many at once. A deleted finding can be brought back for ten minutes.
Evidence
Screenshots with an editor
Paste or drop up to five pictures per finding. Cover sensitive data and mark what matters before the picture enters the report. The edited picture replaces the original, so the covered pixels are not kept.
Requests and responses
Add the raw request and response as a text block under the finding, kept in a fixed-width font and never cut off by the page.
Scanner results
Import Burp Suite, OWASP ZAP and Nessus Pro
Burp XML, ZAP XML or JSON and Nessus .nessus files up to 40 MB. They are read with a safe parser, so a hostile file cannot make the server read other files.
Triage before anything becomes a finding Pro
Results are grouped by kind of issue, and informational or uncertain ones are hidden until you ask. Mark a kind as real, later, a false positive or not relevant. Say “always” and the decision is applied to every future import.
Complete it before it counts Pro
The scanner’s text is a draft you can edit. To promote it you must have a title, the affected asset, a description, the impact and the fix. Its rating always waits for your approval, and requests and responses are never copied in as evidence for you.
The report
PDF with a contents page that is correct
Cover, document control, contents with page numbers, executive summary, scope, methodology, tools, findings and conclusion. You see the real PDF in a preview before you export it. Free reports carry “Generated with CipherProof” in the footer.
An executive summary you can edit
It is written from your findings: counts, overall risk and the most serious issues. Write your own text if you prefer; the risk level and tables still come from the findings.
Six templates, a colour and a logo
Executive, Classic, Terminal, Minimal, Bold and Blueprint. Switch any section of the report on or off, and add a draft watermark while you work.
Retest tracking
Mark each finding open, fixed, verified or risk accepted, with a date and a note. Once a retest starts, the report gets a remediation status section.
Word (.docx) export Pro
The same content and order as the PDF, in a file your client can edit. Its layout is Word’s own, so it is simpler than the PDF.
Brand kit Pro
Set your logo, colour and company name once. New projects start with them, and the footer carries your company name instead of ours.
Working faster
Search everything with one shortcut
Press Ctrl K (or ⌘K) to jump to a step, a finding or another project, or to run an action such as exporting.
Keyboard shortcuts
Move through findings with J and K, tick with X, approve with A, add with N. Press ? to see them all.
Version history
A version is saved each time you export and before a restore. Compare any version with the report as it is now, and go back to it. Free keeps 5 versions; Pro keeps 30.
Your data stays yours
Export everything in your account, or delete the account and every project in it.
Try it on a real engagement.
The free plan includes one project. No credit card.
Get started, it's free