PlexTrac for Pentest Reporting: See the Platform in Action

Summary

Dan Declaus, founder and CTO of Plex Track, showcases Plexra, a platform designed to streamline pentesting and security assessments. The demo highlights scheduling engagements, creating reports with pre-built templates, executing test procedures, and managing findings with AI-assisted descriptions and automated risk scoring. Plexra enables real-time team collaboration, client notifications, and seamless workflow automation, including integration with Jira and ServiceNow. Users can prioritize critical vulnerabilities, link findings to assets and programmatic risks, and export fully formatted reports. Overall, Plexra simplifies reporting, enhances efficiency, and allows security teams to focus on high-impact tasks, making pentesting more effective and organized.

Takeaways

• 😀 Plexra is designed to help pentesters and security assessment teams streamline engagements and focus on high-value tasks like finding exploits and collaboration.
• 😀 Users can schedule pentests, define clients, scope, test windows, and upload related files directly within the platform.
• 😀 Pre-built report templates allow for quick generation of narratives and findings, saving time and ensuring consistency.
• 😀 Test plans and procedures, based on MITRE ATT&CK methodology, guide testers while allowing flexible execution and collaboration between Red and Blue teams.
• 😀 Findings can be created manually, imported from write-up databases, or integrated from scanning tools like Nessus, and include CVSS scores, screenshots, recommendations, and affected assets.
• 😀 Plexra’s AI module assists with generating descriptions and recommendations for findings, helping reduce writer’s block and speed up report drafting.
• 😀 Workflow automation enables automatic actions like triaging critical findings, closing informational findings, publishing notifications, and linking to Jira or ServiceNow tickets.
• 😀 Reports can be published to clients with all findings and narratives, automatically triggering relevant workflows for critical issues.
• 😀 The platform supports collaborative editing with track changes, enabling real-time team QA and contributions during the report writing process.
• 😀 Plexra’s priorities module links findings to programmatic areas of risk, assigns risk scores to assets, and helps users prioritize remediation efforts effectively.
• 😀 Exporting reports into custom templates is simplified, including auto-generated tables of contents, screenshot integration, and shortcode replacement to streamline formatting.

Q & A

Who is Dan Declaus and what is his role at Plexra?

Dan Declaus is the founder and CTO of Plexra, and he is also a professional penetration tester (pentester).

What is the primary goal of Plexra according to Dan Declaus?

The primary goal of Plexra is to help pentesters and security assessment teams stay focused on the most important work—finding complex exploits, collaborating effectively, and managing risk—while streamlining report creation and engagement management.

How can a user schedule a new penetration test engagement in Plexra?

Users can schedule a new engagement by selecting the client, providing the scope and description, choosing testing windows, optionally uploading related files, and assigning testers and dates for the engagement.

What are some ways Plexra allows users to generate reports quickly?

Plexra allows users to generate reports using prebuilt templates that populate narrative sections, associate findings layouts, assign reviewers, and apply tags, which significantly reduces the time needed to create reports from scratch.

How does Plexra support test plans and procedures?

Plexra enables users to create standardized test plans with procedures, including MITRE ATT&CK-aligned methodologies, which can guide testers through each step of an engagement and track completion and asset involvement.

What methods are available for adding findings in Plexra?

Findings can be added manually, imported from a write-ups repository, or imported from scanning tools like Nessus. Users can assign CVSS scores, risk scores, recommendations, affected assets, and statuses.

How does Plexra's workflow automation engine enhance engagement management?

The workflow automation engine automates handling of findings based on criteria, such as closing informational findings, escalating critical ones, notifying clients, updating statuses, and integrating with Jira or ServiceNow for ticket management.

What AI features does Plexra offer for report writing?

Plexra uses AI to generate descriptions and recommendations for findings, helping pentesters overcome writer's block and quickly populate report sections with industry-informed content.

How can users collaborate on reports within Plexra?

Users can collaborate in real-time with multiple team members, using track changes, shared editing, and QA workflows to ensure accuracy and consistency throughout the reporting process.

What functionality does Plexra provide for prioritizing and managing risks?

Plexra allows users to assign findings to programmatic risk areas or priorities, link them to affected assets, and calculate composite risk scores, helping clients focus on the most critical issues first.

How does Plexra handle report publishing and client notifications?

Reports can be published to a client portal, with all findings and narratives made accessible. Workflow automations trigger triage, notifications, and Jira ticket creation, ensuring clients are promptly informed of critical issues.

What benefits does exporting reports in templated formats offer?

Exporting in templated formats like Word or PDF saves time by automatically formatting the report, inserting findings, screenshots, and table of contents, allowing pentesters to focus on analysis rather than manual formatting.