In the app today
- Ownership proof by DNS TXT record or well-known file
- Signed scope PDF, with signer, acceptance time and file hash
- Requests and credit ledger, kept apart by account and market
- A public sample desk
From signed scope
to evidence of the fix.
Pentforge is a security assessment workspace from Norcode SRL, a Romanian company serving the EU. Today it holds the proof that you may test a target. Testing, finding review and remediation support are proposed separately for each engagement.
We assess only assets you own or are authorised in writing to test.
Alpha, limited access. You can prepare a request and view labelled sample records. Submitting stores a queue reference and does not start a live scan.
Illustrative recordatlas.example.test
- Scope signedRecorded
Signer, acceptance time and file hash
- Ownership provedRecorded
DNS TXT record on atlas.example.test
- Finding draftedDraft
Session cookie settings, engine draft
- Fix assignedTo be agreed
Owner, due date and verification checks
- Named practitionerAwaiting a person
Nobody has validated this finding
- Closure evidenceNot collected
Cannot close without it
- Operator
- Norcode SRL
- Live market
- EU
- Stage
- Alpha, limited access
- Commercials
- Written proposal, no list price
What works today,
and what does not.
Sample records are labelled. Planned items stay listed as planned.
What you could show an auditor
The record behind each question, and how far it has got.
| Question | Record | Status |
|---|---|---|
| Who authorised this test? | Signer, email, acceptance time, file hash | In the app |
| Do they control the target? | Proof method and verification time | In the app |
| How old is this finding against its SLA? | Age and SLA on one component | Sample only |
| Who owns the fix? | Owner and due date | Built, not connected |
| Who validated it, and what did they change? | Practitioner name, date, before and after text | Built, not connected |
| Did the fix work? | Written checks and a recorded result | Sample only. No retest runs |
| What did the tooling touch? | No run record. The app adapter connects to no engine | Not available |
| What is our exposure by owner across the estate? | No organisation view | Not available |
Built, not yet connected
- AetherOPS draft guidance with references and field provenance
- Priority rationale and verification steps
- Named practitioner validation with a record of each edit
The app adapter remains network-free. None of this is a live customer deployment.
By written agreement
- Practitioner assessment and finding review
- Implementation support for approved changes
- Retesting against agreed acceptance criteria
- Recurring security and compliance-evidence reviews
Inside the working alpha.
The signed-in overview shows your saved requests, their status and the applications assigned to your account. The graph here is synthetic. Access is limited while we verify integrations.
Open the alpha workspace
DomainSubdomainIPPortServiceEndpointTechnologyDemo observationDemo reference
atlas.example.test · Domain
This node is invented. Its category shows how RedAmon represents related assets and observations.
- has subdomain
- has subdomain
- has subdomain
- has subdomain
- has subdomain
- has subdomain
AI security.
What can your agents reach?
Pick a workflow to see what we would review: retrieved documents, agent permissions or a model release. Nothing here tests a system.
Keep retrieved content inside its permission boundary.
A documented boundary between your data, the model and its users.
Explore the AI security workflowScope each piece
of work on its own.
A finding needs an owner, a response and proof the response worked. Assessment, remediation and maintenance each get their own written scope.
Agree the boundary first.
Name the assets, the testing depth and the reviewers. Prove ownership and attach the signed scope.
Assess the exposure
A web, API, network or cloud-configuration assessment of assets you own or may test under written authority. The proposal names the testing depth and who reviews the findings.
Read the authorised testing policyPlan the remediation
Turn a finding into defensive steps, references and verification checks. If your team wants help delivering a fix, the proposal sets out who does what.
See the remediation approachMaintain the evidence
An optional retainer for backlog reviews, evidence updates and agreed retests as your systems change.
How engagements are scopedEvery fix needs
an owner and a check.
We start from a defined backlog, agree who does the engineering, and decide up front what evidence will show each change worked.
- Priority, with the rationale written down.
- Containment kept apart from the permanent fix.
- Change approval stays with your team.
- Verification checks agreed before the change.
Illustrative findingDraft · not validated
Strengthen session cookie settings
Example guidance for an application you control. No customer system was tested.
- Proposed fix
- Review Secure, HttpOnly and SameSite attributes against the application’s authentication flow.
- Verification plan
- Inspect the issued cookies and test the signed-in flow in an approved environment.
Guidance is a draft. A person approves each change, and our remediation policy requires verification evidence before closure.
No list price.
Agreed in writing first.
A written proposal sets the assets, access, deliverables, practitioner involvement, retest allowance, change approval and exclusions.
Understand your exposure
Scoped assessment
Agree what needs testing, how deeply, and what evidence your team needs to act.
- Named assets and written authorisation
- Testing depth and practitioner review agreed
- Findings and deliverables defined up front
- Retest window and allowance specified
Move findings towards closure
Remediation add-on
Add support for prioritising findings, planning fixes and reviewing the evidence of change.
- Separate from the assessment scope
- Agreed finding backlog and engineering support
- Customer-approved changes and verification plan
- Implementation and retesting explicitly included or excluded
Keep the work moving
Maintenance by agreement
Discuss a recurring programme around your estate, team capacity and evidence needs.
- Agreed assets, cadence and review capacity
- Backlog and compliance-evidence reviews
- Response windows and retest allowance in writing
- Additional work requires an approved scope change
Each engagement can be scoped on its own.
See how we scope the workBefore we start.
What the platform does, where people take responsibility, and how the engagement is agreed.
What can we do in the app today?
Sign in with Google to create an account, prepare an assessment request, verify ownership and attach a signed scope. Submitting debits workflow credits and records a queue reference; it does not start a live scan. The protection desk uses labelled sample data.
Who operates Pentforge, and where is our data?
Norcode SRL, a Romanian company, operates Pentforge and serves the EU. The application and its database run in Frankfurt, behind Cloudflare, and records are kept apart by market and account. Several providers are based in the United States; the privacy notice lists each one and where your data can go.
What must be in place before any test?
Proof of ownership or written authority from the system owner, and a signed scope naming the systems, assessment types, testing window and escalation contacts. Expanding the scope needs a new signed document. Denial-of-service testing needs explicit authorisation, and we never scan prospects.
What does your tooling touch today?
The ownership check looks up a DNS record or reads one file on the host you name, and refuses private and metadata addresses. The app’s engine adapter is network-free, so no assessment runs from it. An assigned operator console can read whether our tools are up; it does not start a scan.
Who decides that a finding is validated?
A named practitioner. AetherOPS writes drafts and cannot mark them reviewed. Automated output carries an amber label saying it is an AI candidate and not human-reviewed. This validation step is built but not yet open to customers. We introduce the people working on your assessment once you engage us.
Does AetherOPS fix production automatically?
No. It prepares draft guidance. The sample desk does not log in to a host or apply a change. Implementation needs an agreed scope, your approval and an accountable person.
When is a finding closed?
When a named practitioner has validated the guidance and verification evidence supports closure. An HTTP response or an AI-generated answer is not proof of a fix. Retesting is by request, within the agreed scope and allowance.
How is the price agreed, and what are credits?
We scope the assets, access, depth, deliverables and practitioner time before quoting. Remediation is a separate add-on. Credits are account workflow units: not money, a service quote or a promise of testing, review or remediation capacity. A new account receives 200. The first queued pass is 120 and a later pass is 20. The first consultant hour is free, and each later hour is 200. Any delivery commitment is agreed separately in writing.
Does this make us compliant?
No. Remediation records can support audit preparation, but they do not issue a certificate or guarantee legal compliance. We publish no SOC 2 or ISO 27001 certificate. Your organisation and its advisers remain responsible for compliance decisions.
Where are your retention, DPA and breach-notice terms?
We have not published them yet. Our legal pages are drafts and mark each open term. Ask before you share any data: [email protected].
Start with one system.
Tell us what you want assessed and what your team can take on. We will tell you what can be scoped during the alpha.