Send Pentrova findings where your team already works.

Integration questions

• Common objection We already have a scanner — why add another tool?

  Most scanners score findings probabilistically, which is why AppSec queues grow faster than they shrink. Pentrova only publishes findings our verifier can reproduce, so you are not adding a second queue — you are retiring the unreproducible half of the first one. The product is engineered so backlog should shrink as Pentrova lands, not expand.
• Common objection Aren't you too expensive compared to free open-source tools?

  Free scanners are excellent at what they do and we ship our own four free tools for that reason. Pentrova replaces the human hours teams spend triaging and reproducing probabilistic findings, not the scanners themselves. The pricing is set so a verified PoC bundle costs less than the engineering time a probabilistic queue would consume.
• Common objection DAST scanners are too noisy — what stops Pentrova from drowning us in alerts?

  Every candidate finding is replayed in a clean session by our verifier and the differential signal that flagged it — status code, response body hash, sensitive byte sequences, error patterns — is compared against a clean baseline before it becomes a ticket. Findings whose differential does not reproduce never enter the queue. In practice that turns the "noise vs signal" ratio into a binary gate: if the differential reproduces, it is signal.
• Which destinations does Pentrova ship as first-class today?

  Five notification providers — Slack, Microsoft Teams, Discord, email, and a custom webhook — plus six CI gating templates (GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket Pipelines).
• Where are the integration credentials stored?

  Webhook URLs and integration secrets are stored encrypted at rest, scoped per tenant, and visible only to tenant admins. Failing destinations are auto-disabled after ten consecutive errors so a broken endpoint never silently absorbs notifications.
• Does the webhook payload carry raw exploit content?

  No. The webhook event carries the finding metadata (id, severity, class, chain id, target, evidence URL, created_at). The raw exploit payload and the full evidence stay in the Pentrova evidence store; recipients fetch them via the evidence URL with their workspace credentials.
• Can I map Pentrova severities to my internal severities?

  Severity is included in every event as Critical / High / Medium / Low / Info. Custom mapping happens on the receiving side — for example, in an automation rule keyed on the severity field.
• How are duplicate findings handled?

  Pentrova dedupes findings by fingerprint inside the platform so one bug does not produce one notification per pentest. The webhook fires only when a finding is first confirmed, when its severity changes, or when it regresses after being marked fixed.