PentestPad pitches self-hosted AI so client findings stay in-house
Original title: PentestPad: How Pentest Companies Adapt In The Era of AI
The reporting platform can run air-gapped, point its assistant at a local model, and expose findings over MCP.
Cyber Security News describes PentestPad, a penetration-test reporting and project tool offered as managed cloud or fully self-hosted, including air-gapped deployments. The pitch is that testers already paste client scope, findings, diagrams and credentials into cloud models, risking NDAs and rules such as GDPR or HIPAA. PentestPad says its writing assistant can use a model inside the customer network, draft findings from notes, Burp output, screenshots or logs in the team's own template, and expose fourteen typed MCP tools. Its team is said to use Qwen3 Coder through Ollama with OpenCode or Claude Code.
Unconfirmed: This is a product pitch; no independent evaluation of the tool is included.
- Client findings, scope documents and credentials are the data the piece says must not leave the network.
- Deployment options named are managed cloud, self-hosted and air-gapped.
- The MCP server is said to expose fourteen typed tools over projects and findings.
- PentestPad's team uses Qwen3 Coder via Ollama, with OpenCode or Claude Code as the harness.
- A command-line agent for macOS, Linux and Windows is also mentioned.
- Products
- PentestPad
- AI models
- Qwen3 Coder
From the original article
9 min read at cybersecuritynews.com
Every penetration testing firm is facing the same pressure right now. AI tools are faster, cheaper, andincreasingly capable, and testers are using them whether the company has a policy on it or not. There’s ahigh change AI has already entered your workflow the question is whether it has entered on your terms oryour employee’s personal […]
By Kaaviya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.