STAGE 01/ 07
Create assessment
Spin up an engagement from a firm template — scope, fields, and severity scale pre-set.
CLIENT
SCOPE
TEMPLATE
Run the whole pentest engagement on one platform. recon beyond sight.
Recon, findings, test plans, team workflow, and white-label client reports — so your firm ships every engagement as good as your best one, faster.
No credit card required · cancel anytime
1 source of truth per engagement 4× faster turnaround, same quality 0 "whose report style is this?"
the problem
Your firm's quality shouldn't depend on who ran the test.
Every boutique hits the same ceiling — the work is good, but it isn't consistent, and the overhead scales with headcount.
✕
Reports look different every time
Each tester has their own template, tone, and severity scale. Clients notice.
✕
Hours lost to manual rework
Deduping findings, reformatting evidence, rewriting the same remediation copy.
✕
No shared source of truth
Findings live in spreadsheets, DMs, and someone's local notes. Leads can't see status.
✕
Onboarding is tribal knowledge
New hires take months to match the firm's process — because it isn't written down.
One platform that owns the whole engagement fixes all four.
the engagement lifecycle
One assessment, owned end to end.
From kickoff to remediation tracking — every stage in one system, visible to the whole firm.
Create Recon Findings Test plans Review Report Deliver
scroll to advance the engagement →
the platform
Everything a pentest practice runs on — in one place.
Design your own recon, manage the test like a board, ship reports in your brand, and hand clients a live portal. Four console capabilities, one engagement.
01 / RECON
Design your own recon
Build recon as a visual flow — chain subfinder, dnsx, httpx, nuclei and your own steps into a DAG, branch where you need to, and run it Lite or Full. Findings land in the engagement automatically.
- visual flow editor
- subfinder → httpx → nuclei
- auto-generated findings
Backlog 3
SSRF · webhookRL
IDOR · billingMK
Testing 2
SQLi · /api/v2JD
Review 1
XSS · profileJD
Done 4
✓CSRF · settings
02 / WORKFLOW
Run the test like a board
Every finding moves across a full Kanban — backlog, testing, review, done. Assign owners, gate on lead review, and see exactly what's blocked without a status meeting.
- status & ownership
- lead review gates
- WIP at a glance
Firm default Exec summary PCI-DSS Retest
ACME-Q2PDF · PPTX
03 / REPORTS
Reports in your brand
Assemble a white-label PDF or PPTX from your firm's template — logo, cover, severity scale, and attacker-POV narrative. Multi-language, and consistent every single time.
- white-label PDF & PPTX
- firm templates
- multi-language narrative
acme.tandera.io
remediation 67%
resolvedSQLi · /api/v2
in progressSSRF · webhook
openIDOR · billing
04 / DELIVERY
A live client portal
Hand clients a branded portal instead of a static PDF — findings, evidence, and live remediation tracking, so the engagement keeps proving value long after delivery.
- branded client portal
- remediation tracking
- live status for clients
why firms standardize on Tandera
Three outcomes your clients feel.
01 / CONSISTENCY
Standardized process
Pre-generated test plans, one canonical findings schema, and status / assignment / review built in. Every engagement runs the same way — regardless of who's on it.
- firm-wide templates & severity scales
- role-based access & review gates
- status and ownership across the team
Queued
JD
SQLi · /api/v2 MK
IDOR · billingTesting
RL
SSRF · webhookReview
JD
XSS · profile02 / SPEED
Less manual work
Automated recon, automatic dedup and correlation, and AI that drafts descriptions, remediation, and business impact. Your testers spend their time testing — not formatting.
- Lite & Full automated recon
- dedup & cross-tool correlation
- AI-drafted narrative & remediation
nuclei
CVE-2024-3400 · pan-os
CVE-2024-3400 · pan-os
burp
CVE-2024-3400 · gateway
CVE-2024-3400 · gateway
nessus
CVE-2024-3400 · fw-edge
CVE-2024-3400 · fw-edge
CRITICAL TDR-0042 · CVE-2024-3400
03 / QUALITY
Reports clients respect
PDF and PPTX, attacker-POV narratives, multi-language, fully white-label — plus a client portal with live remediation tracking. Deliverables that justify your rates.
- white-label PDF & PPTX
- attacker-POV narrative generation
- client portal + remediation tracking
ACME-Q2.PDFWHITE-LABEL
under the hood
Your testers keep their tools — and their speed.
The engine is a single-binary Rust CLI that pipes straight into the assessment. No CSV exports, no copy-paste, no re-keying.
Your testers keep their tools and their speed. Your firm gets one source of truth.
$tanderaexport scope-a abc-123 --format txt\
|httpx-silent|nuclei-jsonl\
|tanderaimport pipe-a abc-123 -t nuclei -y
→ scope export: 38 in-scope targets → httpx: 214 live services discovered → nuclei: results streaming back… ✓ 42 findings imported · 9 deduped · into one shared
assessment
Bring your team's tools. Tandera makes them one record.
burpnucleizapcaidonessusnmap
built for teams
Scale headcount without scaling chaos.
The controls a practice lead needs to run a growing firm — visibility, consistency, and onboarding that takes days, not months.
[SHARED]
Shared assessments
One live workspace per engagement. Everyone sees the same findings, the same status.
[RBAC]
Roles & permissions
Testers, leads, and admins get exactly the access they need — and nothing they don't.
[TMPL]
Consistent templates
Lock the firm's report style, fields, and severity scale so every deliverable matches.
[VIS]
Lead visibility
See every engagement, who's on what, and what's blocked — without a status meeting.
[ONBD]
Fast onboarding
New hires inherit the firm's process on day one. Test plans teach the method.
[AUDIT]
Audit & accountability
Every change tracked. Defensible deliverables and a clear record for the client.
why Tandera
Reporting tools own the last mile. Tandera owns the whole road.
Reporting-only
(SysReptor / Dradis)
(SysReptor / Dradis)
Tandera
Automated recon (passive → active)
—
Lite & Full
Canonical findings, dedup & correlation
manual
automatic
Pre-generated test plans
—
built-in
Team workflow, roles & review
partial
native
White-label reports + client portal
reports only
both
Tools to run a full engagement
a stitched stack
one platform
one platform replacing a stitched-together stack — less tooling cost, less context-switching.
pricing
Priced for firms that ship.
Most teams run on Pro — full recon, AI enrichment, and white-label, with seats for the whole practice.
Free
$0/mo
- 1 active engagement, up to 3 teammates
- Lite recon and OWASP checklists
- 2 branded reports per month
Solo
$41.58/mo
billed annually · $499/yr
- 1 seat, up to 5 clients
- Full recon and OWASP checklists
- 150 scan credits per month
Most Popular
Pro
$208.25/mo
billed annually · $2,499/yr
- 10 active engagements, up to 10 teammates
- Full recon, scanner imports, attack chains
- Branded reports, DocuSign, 5 reports/mo
Enterprise
Custom
- Unlimited engagements, mobile recon, advanced categories
- Custom report templates and API access
- Priority support and audit retention
all plans include the CLI engine · migrate from SysReptor or Dradis with white-glove onboarding