Solutions

OWASP Faction is open source penetration testing management software: a pentest reporting tool, a collaboration platform for security assessment teams, and a vulnerability management system with remediation tracking, in one self-hosted application. These pages describe the problems it is built to solve.

• Automate Pentest Reporting — generate penetration test reports from your own Word templates, with every finding, screenshot and severity table filled in.
• Write Pentest Reports with AI — turn a tester's steps to reproduce into descriptions, recommendations and executive summaries, in your house style, with prompts you control.
• Manage Large Penetration Testing Teams — schedule engagements against a shared calendar, work on assessments together, and put every report through peer review.
• Track Vulnerabilities and Remediation SLAs — follow every finding from report to retest to closure, with owners, SLA clocks, exceptions and dashboards.

Who it is for

• Penetration testing consultancies that deliver client reports every week and need the report, the review and the retest to be part of one workflow.
• Internal application security teams that run assessments across many applications and need to know what is open, who owns it and how late it is.
• Red teams and bug bounty triage teams that need findings recorded once and tracked to closure.
• Managed security service providers that run assessments for many customers and need organizations, dashboards and access control between them.

Why it is open source

Faction is published as an OWASP project under Apache-2.0, self-hosted with a one-command Docker install, and the open source edition does not cap users. Your findings stay on your infrastructure, the extension API and REST API are public, and the source is yours to read and change.

Ready to try it? Run it with one command.