FAQ

Running tests¶

Can Pentr test behind a login?¶

No. There is no way to pass credentials to the agent, so every run is unauthenticated. See Scope.

Can I re-run an engagement?¶

No. A completed or failed engagement cannot be submitted again; create a new engagement with the same targets, scope, rules and framework. See Retesting after remediation.

Can I cancel or pause a run?¶

No. The console and the API have no cancel, pause or abort, for a queued engagement or a running one. See Lifecycle.

Does the maximum duration stop a run?¶

No. The duration is written into the rules-of-engagement document and nothing enforces it. See Rules of engagement.

How many runs can I have at once?¶

The scheduler runs one engagement at a time, and the rest wait in the queue. Separately, your tier caps how many engagements may be queued or running when a schedule fires. See Running an engagement and Plans and limits.

Why was my launch blocked, and how do I retry?¶

The ownership re-check at launch could not prove an identifier, and the 409 response names each one and the reason. Fix the proof and submit the same engagement again with POST /api/engagements/{id}/submit; the console has no button for this. See Ownership verification.

How do I prove I own an IP address or range?¶

By attestation: an organization owner calls POST /api/assets/{asset_id}/attest with a written justification. No automated check exists for IP, CIDR or URL assets, and an attestation lasts 90 days. See Ownership verification.

Can I change a schedule's targets?¶

No. The targets, scope, rules and framework of a schedule are fixed when it is created; delete it and create a new one. See Managing a schedule.

Frameworks and findings¶

Which frameworks are supported?¶

Six: SOC 2, ISO 27001, ENS, PCI DSS, OWASP ASVS and NIST CSF. See Frameworks.

Can I add my own framework?¶

Not from the console or the API. A framework is a YAML file deployed with the application. See Custom frameworks.

Does tested mean a control passed?¶

No. tested means at least one finding mapped to the control; it is not a judgement that the control is met or failed. See Frameworks.

Are false positives left out of the report?¶

No. A finding marked false_positive or not_exploitable is rendered and counted like any other. Filter on the status column of the CSV or SARIF export. See Anatomy of a finding.

Does Pentr calculate CVSS scores?¶

No. The agent writes the score and the vector, and the application neither computes nor checks them. See Severity and taxonomy.

Why do the PDF and the CSV differ?¶

The PDF is written once, when the report is generated, and the CSV is rebuilt at every download, so a change to the framework file in between can change the control ids. The two also order findings differently. See SARIF and CSV exports.

Evidence and auditors¶

Can an auditor verify evidence without an account?¶

Yes. A share link needs no account, and pentr-verify checks a downloaded locker offline. See Share links and Verifying a locker.

Where does an auditor get pentr-verify?¶

It is open source under the MIT licence at github.com/PentrAI/pentr-verify. See Verifying a locker.

Does a valid seal prove the test ran to completion?¶

No. A run that stopped at a ceiling is sealed the same way as one that finished. A valid seal shows that the evidence has not changed since it was signed. See What verification does not prove.

Is a failed run sealed?¶

No. A failed engagement is never sealed, and has no findings, report or locker. See When a run fails.

How long does a share link last?¶

30 days by default, and anything from 1 to 365 days when you create it. It can be revoked at any time. See Share links.

Account¶

Can I run Pentr on my own infrastructure?¶

No. Pentr is a hosted service operated by Pentr. See What Pentr is.

Can I add a teammate?¶

No. An organization has one user, and the product has no invitation. See Organizations.

Can I rename or delete my organization?¶

No. The product has no rename, and no deletion of an account or an organization. See Organizations.

Where do I manage billing?¶

The console has no billing functions. See Billing.