Structured findings
Every finding carries a CVSS 3.1 vector, a CWE and MITRE ATT&CK references, plus a likelihood and impact rating - so reports read consistently whoever wrote them. Each text field keeps its own history, with a diff and a restore.
Reporting platform
ClearView Report Ledger
Live access to your reports · client portal · reviewed, signed, tracked
Your penetration test report, live in a secure portal - read it, comment on it and track the fixes as the work happens.
Review
A person signs off every report
7
Compliance frameworks mapped
PAdES
Digitally signed PDFs
Audit
Log of every change and download
A report that arrives as an email attachment is out of date the moment it is sent. Questions go back and forth in separate threads, fixes are tracked in a spreadsheet nobody owns, and nobody can say which copy is the final one.
ClearView keeps all of it in one place. Every published version sits in your organisation's portal, newest first, with the supporting documents we share and a checksum so you can verify that a download is exactly the file we issued.
You read the report in the browser and highlight any passage to leave a note. It is tied to that page and quote of that exact version, and our team accepts it, resolves it or rejects it with a reason - you see the answer as it is given.
Behind the portal is the platform our testers work in: structured findings, evidence capture, scanner importers and a human review step on every report before it is signed and published.
See it in action
What your team actually sees
Real screens from the portal, shown with demo data. Click any image to enlarge.
Client portal
One home for everything you need
- Every version, newest first, plus the documents we share
- Signed versions with a downloadable certificate
- Status badges: retest deadline, verified fixes, scope sign-off
Read and comment
Read the report, comment on the exact words
- Reports open in the browser, no attachment to chase
- Highlight text and add a note tied to that page and version
- See our answer - accepted, resolved or rejected with a reason
Client feedback
Your change requests, answered and tracked
- The client highlights text on the issued PDF and adds a note
- Our team accepts, marks changes made, or rejects with a reason
- The next version is issued once every note is answered
Remediation and retests
Fixes tracked, retests on agreed terms
- Owner, status and notes for every finding
- A visible retest window and included retests
- Verified results flow back into the tracker
Built-in peer review
A second pair of eyes on every finding
- Mark ready for review, approve, or request changes with a comment
- Testers cannot approve their own findings
- Comments stay on the finding until the report is final
Inside the portal
What the portal gives your team
Read and comment in place
Reports open in the browser. Highlight text and add a note; testers accept, resolve or reject it with a reason and you are notified.
Remediation and retests
Owners, due dates and status for every finding. Within the agreed window you request the included retest, and verified results flow back into your tracker.
Approval and attestation
Approve the final version and generate a letter of attestation for your customers or auditors: scope, counts and verified fixes, never the finding details.
Scope and rules of engagement
Agreed and e-signed before testing starts: targets, hours, emergency contacts and deconfliction. The signed PDF is the authorisation record.
Versions and shared files
Every published version in one folder, newest first, plus the supporting documents we choose to share. Notifications carry only a title and a link.
Pick the cover of your reports
Five cover designs, each carrying our branding. Choose one for your whole organisation and published reports are re-generated with it before you download - every other page stays exactly as it was issued.
Ask the Report
Where your own AI policy allows it, ask questions about the report you are reading and get answers drawn from that published version alone.
Signed and verifiable
Each issued PDF is digitally signed, and a download certificate and SHA-256 checksum let you verify it.
Behind the portal
How the report you read gets built
ClearView is the platform our testers work in, not a template they fill in at the end. Evidence lands in the report while the testing happens, every finding has the same shape, and the mapping and charts your stakeholders need are generated rather than assembled by hand.
Evidence captured as we test
A browser extension to snip, crop, box and black out a screenshot and send it straight to a finding, plus a command-line tool and a Burp extension. A screenshot sits exactly where the text refers to it, rather than in an appendix nobody reads.
Scanner results, reviewed in
Nessus, Nmap, Burp and OpenVAS output is imported, de-duplicated against what is already there, and reviewed finding by finding before any of it reaches your report. A scanner never writes to your report on its own.
Compliance mapping, built in
Only the frameworks you actually need are switched on, findings map from their CWE or by suggestion, and an appendix links every control back to the findings that touch it.
Risk you can show a board
A likelihood and impact heatmap, findings by category, the most affected hosts, ATT&CK coverage and retest progress - each one switchable per report, so an executive summary says what that engagement actually found.
Your document, not a generic one
Reports keep Word-template fidelity, and earlier reports written in Word can be imported into the platform and published to your portal alongside the new ones - keeping the cover of the original template.
Human review, every time
No report leaves without people signing it off
Review is part of the workflow, whether a finding was written by hand, imported from a scanner or drafted with a suggestion. Testers cannot approve their own findings; only a reviewer or the report lead can approve one or send it back, and a read-only reviewer role means the person judging the text is not the person editing it. The full trail of who changed, approved or signed what is kept.
-
Ready for review
The tester marks a finding finished.
-
Reviewer decides
A second person approves, or requests changes with comments.
-
Lead finalises
Only a report lead marks it final.
-
You review
Notes, approval and a signed version in the portal.
How an engagement flows
From scope to proof of fix
Scope and RoE
You review and sign; we countersign.
Test and capture
Evidence and scan results flow in.
Write and review
Findings are written, then approved by a second person.
Issue
The signed PDF is published to your portal.
Fix and retest
You track the fixes, we verify them.
Security and privacy by design
Your reports are the most sensitive thing we hand you
Only your organisation
Clients sign in to see only their own organisation's published reports, with two-factor login and login rate limiting.
Self-hosted and audited
Your data stays on infrastructure we control, with encrypted backups that are verified by restore, an audit log of changes, downloads, sign-ins and approvals, and render workers that have no internet access at all.
AI only where you allow it
AI is a supporting tool, never the author. Each client sets their own policy - disabled, local models only, anonymised cloud or full cloud - and once you have set it, not even an administrator can override it. Every request is logged.
See it on your own engagement
We will walk you through a live report, from imported scan to signed PDF to client portal.