Freedom251 › Penetration Testing Software
Cairn
What Cairn is
Cairn is a platform for offensive security teams and penetration testing firms. It combines pentest scoping, statements of work, reporting, and a client portal across the engagement lifecycle, from RFP scoping through findings, report delivery, and retesting. Its library lists approximately 2,476 curated findings across 26 test types, with CWE, CVE, and MITRE ATT&CK references. Report can auto-detect imports from 40 scanner and tool formats, including CSV and JSON, and supports Open Pentest Format import and export. Connectors include Salesforce, HubSpot, Jira, GitHub, DocuSign, and Dropbox Sign, among others. Cairn runs as hosted SaaS or self-hosted with Docker, Kubernetes, or bare metal, including air-gapped deployment. AI drafting can redact client names, IPs, and hostnames before processing and use local models. Security features include MFA, granular RBAC, tenant isolation, TLS 1.3, and an audit trail. Cloud plans start at $99 a month per seat, billed annually.
Who it suits
Cairn suits offensive security teams and penetration testing firms managing complete engagement workflows. Self-hosted and air-gapped options fit organizations with deployment or isolation requirements.
What it does well
- Covers scoping through retesting
- Approximately 2,476 curated findings
- Imports 40 scanner formats
- Self-hosted and air-gapped deployment
- Client portal users are unlimited
What to know first
- No free plan
- Cloud pricing is per seat
- Cairn is not yet certified
- On-prem plan starts at 30000.00 USD yearly
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Team | annually; month-to-month available at about 20 percent more · $149 seat / mo · unlimited DOCX/PDF templates · priority support | $149 a month |
| Business | annually; month-to-month available at about 20 percent more · $249 seat / mo · unlimited DOCX/PDF templates · priority support + SLA | $249 a month |
| On-prem & air-gapped | per organization / year; from $30,000 · Self-hosted or air-gapped platform · RSA-signed licenses · dedicated support | $30,000 a year |
| Starter | annually; month-to-month available at about 20 percent more · $99 seat / mo · 1 DOCX/PDF template · community support | $99 a month |
As cairnsecurity.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Verdict
Cairn brings pentest operations, reporting, integrations, and client access into one platform. It offers flexible deployment and detailed security controls, but cloud use is seat-priced and the product states that formal third-party certifications are not yet in hand.
Facts from Cairn's own pages
- AI
- AI drafting can redact client names, IPs, and hostnames before model processing, and can run with locally hosted models or in an air-gapped environment. · cairnsecurity.com, 8 Oct 2026
- Audience
- Cairn describes its platform as built for offensive security teams and penetration testing firms. · cairnsecurity.com, 8 Oct 2026
- Client portal
- The client portal supports SSO, magic-link or password sign-in, white-label branding, client requests, and unlimited client users across pricing tiers. · cairnsecurity.com, 8 Oct 2026
- Compliance
- Cairn maps report findings to ISO 27001, SOC 2, NIST CSF, and PCI-DSS controls, but states that Cairn itself is not yet certified and formal third-party attestations are not yet in hand. · cairnsecurity.com, 8 Oct 2026
- Deployment
- Cairn is offered as hosted multi-tenant SaaS or self-hosted using Docker, Kubernetes, or bare metal, with an air-gapped option. · cairnsecurity.com, 8 Oct 2026
- Finding library
- Cairn lists approximately 2,476 curated findings across 26 test types, with CWE, CVE, and MITRE ATT&CK references. · cairnsecurity.com, 8 Oct 2026
- Imports
- Report supports auto-detected imports from 40 scanner and tool formats, including generic CSV and JSON, and supports Open Pentest Format import and export. · cairnsecurity.com, 8 Oct 2026
- Integrations
- Listed connectors include Salesforce, HubSpot, Pipedrive, ConnectWise, Monday, Jira, ServiceNow, GitHub, Azure DevOps, Linear, DocuSign, and Dropbox Sign. · cairnsecurity.com, 8 Oct 2026
- Pricing limits
- Pricing is per seat for cloud tiers, and the page says client portal users are not seats and are unlimited on every tier. · cairnsecurity.com, 8 Oct 2026
- Product tour
- Cairn offers a two-minute click-through product tour with no signup. · cairnsecurity.com, 8 Oct 2026
- Purpose
- Cairn combines pentest scoping, statements of work, reporting, and a client portal in one platform. · cairnsecurity.com, 8 Oct 2026
- Security
- The security page lists TLS 1.3 with post-quantum X25519MLKEM768 key exchange, MFA, granular RBAC, tenant isolation, and a cryptographically chained audit trail. · cairnsecurity.com, 8 Oct 2026
- Support
- Cairn lists community support for Starter, priority support for Team, and priority support plus SLA for Business; its contact page says it usually answers within a business day. · cairnsecurity.com, 8 Oct 2026
- Workflow
- The platform covers the engagement lifecycle from RFP scoping through findings, report delivery, and retesting. · cairnsecurity.com, 8 Oct 2026
Where Cairn stands on Freedom251
- Penetration Testing Software#26 of 34