NOCTARA RED
Evidence in.
Client-ready report out.
Noctara Red is an AI-native workflow and reporting platform for penetration testing teams. Full QA, governance and audit trail in between.
THE BOTTLENECK
Your team tests fast.
Then loses the week to reporting.
Senior testers report spending more than half an engagement assembling the report rather than testing. That half is where Red works.
HOW IT WORKS
Tool output in.
Signed-off report out.
01
Bring the evidence in
Upload Nmap, Nuclei, Burp or testssl output, or write findings by hand. Both paths produce the same structured finding.
02
Findings, scoped and rated
Every finding cites the scope item that authorised it. Severity is derived from CVSS, EPSS and KEV data rather than assigned by a model.
03
Report, QA’d and delivered
Draft on a drag-and-drop canvas, gate publishing behind QA sign-off, then share a portal link scoped to your client’s email.
THE PLATFORM
One environment for the
whole engagement.
GUARDRAILS
AI accelerates.
It does not decide.
THE IMPACT
The report is where the
engagement time goes.
0%
0%
Of an engagement spent writing it up
0%
0%
Less time spent on reporting with Red
0hrs
0hrs
Recovered on a typical engagement
Modelled from pilot baselines and customer interviews with UK pentest firms. Actual results vary by team, workflow and engagement mix.
ROI CALCULATOR
See the return
before you commit.
Adjust the sliders to match your team.
Estimates assume a 60% reduction in reporting time across the engagements your team runs in a year, modelled from pilot baselines. Actual results vary by team, workflow and engagement mix.
PRICING
Priced for the firms
the incumbents priced out.
Red is priced per team and engagement volume rather than off a public list. Tell us how your firm works and we will scope it with you.
FAQ
Questions from
pentest teams.
What can Red ingest?
Nmap, Nuclei, Burp and testssl output today, plus findings written by hand. Both paths produce the same structured finding, so imported work is never second class.
How much does the AI actually do?
It drafts prose: titles, descriptions, remediation and the executive summary. It does not assign severity, invent an asset or file a finding. Every suggestion waits for a tester to accept it.
Who signs off a report?
A tester who did not author the finding. QA sign-off is required before publishing by default, and editing a finding after approval invalidates that sign-off.
How do clients receive reports?
Through an authenticated portal link scoped to their email or domain, or as a PDF, DOCX or Markdown export generated from the same source.
Where does Red run?
Fully managed SaaS, built in the UK for UK and European buyers.
Is Red still in private beta?
No. Red is generally available. Pricing is scoped per team rather than published as a list, so talk to us and we will size it with you.
Get the week back.
Ship the report.
See Red on one of your own engagements. Thirty minutes, no preparation needed.