PlexTrac is a penetration test reporting and exposure management company. It gives security teams and testing firms one place to collect findings from their tools, write and deliver reports, decide what to fix first and track remediation to the end.
The platform serves two kinds of buyer: enterprise security teams running their own testing and vulnerability programmes, and service providers that deliver penetration tests to clients and share results through a client portal.
At A Glance
| Vendor | PlexTrac (acquired by Brinqa) |
|---|---|
| Category | Pentest reporting and exposure management |
| Deployment | Multitenant cloud SaaS, private hosted instance, or client hosted on Docker |
| AI | Plex AI report writing assistant |
| Customers | Mandiant (Google), KPMG, NBCUniversal, Telenor, Dragos |
| Certifications | ISO/IEC 27001:2022, SOC 2 Type II |
| Market classification | Vulnerability Management |
What PlexTrac Does
Offensive security work tends to end in a slow, manual step: copying scanner output and tester notes into a document, then chasing fixes through email and tickets. PlexTrac turns that into a workflow. It pulls findings from scanners, automated pentesting tools, bug bounty platforms and adversary emulation tools into one record, so testers write once and reuse content.
The same record then drives prioritisation and remediation, so the platform can support a Continuous Threat Exposure Management (CTEM) programme, where testing, prioritisation and remediation run as a cycle rather than a once a year report.
Products
Reporting
Reporting is the original core, built for testers and consultancies who spend too long formatting deliverables. Findings are written in the platform, checked through Quality Assurance workflows that support editing, commenting and proofreading, and published through custom templates. A Content Library stores reusable findings text. Testers can score issues with a CVSS calculator, record CVE and CWE references, and use drag and drop Attack Path Visualisation to show the tactics, techniques and procedures in a simulated attack.
Priorities
Priorities helps security leaders move from long lists of findings to a short list of problems. It groups findings and assets by theme to expose root causes, ranks the groups, and assigns them to owners with notifications and progress tracking. Scoring uses a contextual equation that works out of the box or can be tuned to the organisation’s risk appetite, and graph and chart views show stakeholders how risk is falling over time.
Plex AI
Plex AI is a report writing assistant. It drafts descriptions and recommended remediation steps for findings, and it analyses large data sets to summarise the main themes for a report narrative, which lets teams produce findings at scale. PlexTrac builds on Google Cloud’s Vertex AI platform.
Engagement Management
Runbooks, Assessments, Asset Management, Analytics and the Scheduler help teams plan and run engagements, with real time collaboration between testers. A workflow engine automates pentest delivery and the vulnerability lifecycle, and the Client Portal lets service providers share results with their clients.
How It Works
PlexTrac can be deployed three ways:
| Component | What it does |
|---|---|
| Cloud SaaS | A multitenant service that teams can start using without provisioning a server. |
| Private hosted | A private instance that keeps the customer’s data segregated from other tenants, and can run under the customer’s own subdomain. |
| Client hosted | An on-premises deployment using Docker containers, in a physical data centre or a cloud environment the customer chooses. |
Whichever model is used, data flows in through connectors to testing and scanning tools and flows out to ticketing and collaboration systems.
Integrations
| Area | Integrations |
|---|---|
| Vulnerability scanners | Burp Suite Professional, Burp Suite DAST, Nessus, Tenable Vulnerability Management, Tenable Security Center, Qualys WAS, Invicti, Acunetix, Checkmarx SAST, Veracode, OWASP ZAP, Nmap, Nuclei, OpenVAS, CrowdStrike Falcon Spotlight, Edgescan |
| Vulnerability management | Qualys VMDR, Qualys Policy Compliance, Qualys SCA, Rapid7 InsightVM |
| Automated pentesting | Pentera, NodeZero by Horizon 3, Cobalt, Pentest-Tools.com |
| Bug bounty | HackerOne, BugCrowd |
| Adversary emulation | Scythe, BlindSPOT by OnDefend, Mitre Engenuity |
| Ticketing | Jira Cloud, Jira Data Center, Azure DevOps, ServiceNow Vulnerability Response, ServiceNow ITSM, ServiceNow IRM |
| SSO | Microsoft Entra ID, Okta, OneLogin |
| Other | Splunk, Microsoft Teams, Slack, Microsoft Defender for Endpoint, Wiz, webhooks |
Company Background
| Founded | 2016, by Dan DeCloss |
|---|---|
| Headquarters | Boise, Idaho, United States |
| Leadership | Andy Langsam (CEO) and Dan DeCloss (founder and Chief Customer Brand Officer) |
| Funding | A $10 million Series A in April 2021 and a reported $70 million Series B led by Insight Partners |
| Ownership | Acquired by Brinqa, with a shared direction of unified exposure management |
| International | UK and European operations |
| Recognition | Included in the Gartner Magic Quadrant for Exposure Assessment Platforms (November 2025) |
Note: This overview is compiled from PlexTrac’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.