Penetration test management platform
Run every penetration test and threat model from a signed authorisation to a branded report: scoped engagements, findings with SLA clocks, scanner imports, retests and remediation tracking.
- Module typeOperational workspace (product module)
- Engagement kinds11, from web app and API testing to red team, code review and threat model
- LifecycleDraft, discovery sent, discovery received, authorised, in progress, reported, retest, closed
- Methodologies21 named with versions, from OWASP WSTG v4.2 and ASVS 5.0.0 to MITRE ATT&CK v18
- Severity SLAsCritical 7, High 30, Medium 90, Low 180 days by default, adjustable
- OutputEngagement and threat-model reports in Word and PDF, findings tracker in Excel
What the security testing workspace covers
Who it applies to
- In-house offensive security and application security teams
- Security consultancies running engagements for several customers
- Organisations evidencing testing requirements such as PCI DSS requirement 11.4, DORA's resilience testing or ISO/IEC 27001 Annex A 8.8 and 8.29
- Product teams threat modelling with data-flow diagrams, STRIDE or LINDDUN
- Security leaders who want findings, SLAs and retest results on one dashboard
This is the workspace a testing team works in, not a testing service. An in-house security team or a consultancy keeps its customers, engagements, findings and reports here, across eleven engagement kinds: web application, API, mobile, external network, internal network, cloud configuration, AI and LLM application, wireless, red team, secure code review and threat model.
Testing starts with permission on record. The customer receives one link, valid for 30 days, signs the authorisation (typed name, title, organisation, time, IP address and browser are stored with it), then answers a discovery questionnaire shaped to the engagement kind. The consent text is captured when the link is sent, so the version signed is the version kept, and the questionnaire cannot be submitted until the authorisation is signed. A tester countersigns, and the consent is produced as a PDF.
Findings are rated by severity band, and the band is the contract: SLA due dates, the dashboard and the threat level all read it. CVSS is evidence for the band: version 3.1 vectors are scored by the platform, version 4.0 vectors are validated, and a score that disagrees with the band is refused on save. Threats are rated with the OWASP Risk Rating Methodology on the server, never trusted from the browser.
Related reading: Risk management in GRCLens
How GRCLens supports Security Testing
Security testing runs on the same platform as the risk register and the framework assessments, so a finding can become a risk and a report can evidence the controls that ask for testing.
Signed authorisation, kept as signed
One link per engagement, signature first and discovery second, with the consent text frozen at send time and the tester's countersignature beside the customer's. No stage can be skipped: a report cannot be issued before the authorisation is signed.
Discovery shaped to the engagement
Questions follow the engagement kind and the business context: industry, data types, hosting, authentication, the ASVS level to verify and AI guardrails, among others. Regulatory drivers name their clause, such as PCI DSS 11.4 or DORA Articles 24 to 27, so the report can cite why the test was done.
Methodologies named with their versions
A report that cites a list without its year cannot be checked, so each methodology carries its version and the date it was checked: OWASP WSTG v4.2, OWASP Top 10 2025, API Security Top 10 2023, Top 10 for LLM Applications 2025, ASVS 5.0.0, MASVS v2.1, PTES, NIST SP 800-115, OSSTMM v3, CWE Top 25 2025, MITRE ATT&CK Enterprise v18, MITRE ATLAS and TIBER-EU / DORA threat-led penetration testing.
Findings with SLA clocks
Critical, High, Medium, Low and Info, with due dates from the band (7, 30, 90 and 180 days by default, set per tenant) and statuses from open and in remediation to fixed, risk accepted or false positive.
Scanner and tracker imports
Import Burp Suite XML, Nessus and Tenable exports, SARIF 2.1 from static analysis tools, and spreadsheet trackers in Excel or CSV, with duplicates detected rather than filed twice.
Threat modelling with a data-flow diagram
Elements, flows and trust boundaries laid out once and drawn twice, as SVG on screen and PNG in the report, so the report shows the picture the customer saw. STRIDE per element, the seven LINDDUN privacy categories and attack trees.
Retests and remediation tracking
Retests record each finding as fixed, partially fixed, not fixed or not retested, and the dashboard tracks overdue findings, findings fixed in the last 30 days, mean days to fix and the retest pass rate.
Raise to the risk register
A finding or a threat can be raised into the risk register as an operational risk, with its owner and treatment, where the tenant also uses Risk Management.
Reports that carry your brand
Engagement and threat-model reports in Word and PDF with your logo, colours and confidentiality footer, marked DRAFT until the engagement is reported, with an AI-drafted executive summary for the tester to edit.
Security Testing frequently asked questions
Is GRCLens a penetration testing service?
No. GRCLens is the platform a testing team works in: authorisation, discovery, findings, retests and reports. If you need testers as well as the platform, Security Solution Consultants delivers the testing itself, linked at the foot of this page.
What is a penetration test management platform?
Software that runs penetration tests as managed engagements rather than documents: scope and authorisation, findings with severities and due dates, imports from testing tools, retests, remediation tracking and reports, across every customer or business unit tested.
How does the signed authorisation work?
The customer receives one link, valid for 30 days. They sign first, and the name, title, organisation, time, IP address and browser are stored with the consent text exactly as it was sent. Only then can they submit the discovery questionnaire. A tester countersigns, and the signed consent is produced as a PDF.
Which scanners can findings be imported from?
Burp Suite XML, Nessus and Tenable exports, SARIF 2.1 from static analysis tools, and spreadsheet trackers in Excel or CSV. Imported findings are checked for duplicates before they are filed.
How are finding severities and SLA due dates set?
The tester sets the severity band, and the due date follows from it: 7 days for Critical, 30 for High, 90 for Medium and 180 for Low by default, adjustable per tenant. A CVSS vector is evidence for the band, and one whose score disagrees with the band is refused on save.
Does it support threat modelling?
Yes. A threat model is its own engagement kind, with a data-flow diagram of elements, flows and trust boundaries, STRIDE per element, LINDDUN privacy threats and attack trees, threats rated with the OWASP Risk Rating Methodology, and a threat-model report in Word or PDF.
Can findings become risks?
Yes. A finding or a threat can be raised into the risk register as an operational risk, where it gets an owner, a treatment and a target, when the tenant also uses Risk Management.
Talk to us about Security Testing
Security Solution Consultants provides penetration testing and security testing services alongside the platform, so you can combine tooling with hands-on expertise.