About Pentrova
We build the agents and chain resolvers that turn vulnerability hunches into findings confirmed on evidence captured from the target. Engineering queues receive evidence, not guesses.
Security tools overwhelm engineering teams with maybe-findings. Pentrova was founded on the premise that the only finding worth acting on is one backed by evidence. The platform is engineered so every finding in your queue was confirmed by AI review of evidence captured from your target, and agents are auditable.
We believe the next decade of offensive security will be won by platforms that ship evidence, not alerts. We are building Pentrova to be that platform for teams who cannot afford another false positive.
Six commitments shape how the platform is engineered. Every one is verifiable the first time you click Run.
Every finding in your queue was confirmed by AI review of evidence captured from your target, and where a finding has a captured HTTP exchange, your engineers can copy it as a cURL command and re-run it. Findings that are not confirmed never enter your queue.
Destructive payloads and methods are blocked by default and request rates are limited. The scan still sends real test traffic to your target and can change data or trigger alerts, so test a staging copy where you can and take backups before testing production.
Scan output can contain working credentials and personal data captured from your systems. Pentrova masks the secrets it recognises (passwords, tokens, API keys and session values) in exports and the live scan view; it does not remove personal data. Scan content is never used to train models, never sold, never shared beyond the named subprocessors.
Where a finding has a captured HTTP exchange, you can copy it as cURL or raw HTTP, or download it as Markdown or HAR, and re-send it without our control plane, so the evidence stays usable in your audit pack regardless of vendor.
Every Pentrova engagement ships a compliance-mapped report — every finding tagged to PCI DSS v4.0.1, ISO 27001:2022, HIPAA Security Rule, and GDPR controls. Pentrova’s own ISO 27001 program is in build; audit timelines are published in the Trust Center as soon as the registrar engagement is signed.
The targets you have verified, the retest window your plan carries, and your integration scopes are all settled before a pentest starts. Retention is stated in the published policies rather than negotiated deal by deal. No surprise data egress, no quota games, no hidden invoices.
Pentrova is privately held. We name the funds and angels backing us as each investor consents to public attribution. For partner-level conversations or strategic introductions, reach hello@pentrova.ai.
