Freedom251 › Penetration Testing Software

PENTRA

Paid Self-hostedWebWindows

What PENTRA is

PENTRA is an on-premises penetration testing and vulnerability management platform for internal security teams and service providers. It executes MITRE ATT&CK techniques and OWASP test cases across internal networks and Active Directory, web and mobile applications, and APIs. Security engineers validate results, Blue Teams mark detections, and findings include proof of execution. Its Open Points tracker requires in-scope techniques to be executed and validated before an engagement can close. PT++ supports Red Team execution alongside Blue Team detection validation in one engagement. PENTRA follows findings through mitigation and retesting, with engineers recording evidence when they check whether a fix worked. It generates PDF and Microsoft Word reports with executive summaries, security and detection metrics, evidence screenshots, and mappings to NIST, PCI-DSS and ISO 27001 controls. Network testing aligns with MITRE ATT&CK and application testing with OWASP. PENTRA is deployed on-premises, needs no cloud connectivity and is described as fully air-gappable. The Network module requires an agent on a customer-provided Windows machine; Web, Mobile, API and Purple modules run from the C2 server. Pricing is available on request.

Who it suits

PENTRA is intended for internal security teams, pentesters, Blue Teams, SOC analysts, administrators and managed security providers. Reacts also offers it as part of a managed penetration testing service, with international and remote delivery.

What it does well

Covers network, web, mobile and API testing.
Tracks findings through mitigation and retesting.
Reports include evidence and framework mappings.
Can operate without cloud connectivity.
Supports simultaneous Red Team and Blue Team work.

What to know first

Pricing is available on request.
Network testing requires a customer-provided Windows agent.
Deployment is on-premises.

Limits

Pricing is on request. Network testing requires an agent on a customer-provided Windows machine; Web, Mobile, API, and Purple modules run directly from the C2 server.

Getting started

Visit the PENTRA platform website
Request pricing and arrange an engagement
Deploy the platform on-premises without cloud connectivity
For Network testing, install the agent on a customer-provided Windows machine
Run Web, Mobile, API, or Purple modules from the C2 server
Execute and validate in-scope techniques, then review reports

Verdict

PENTRA combines technique-level testing, human validation and remediation tracking in an on-premises platform. Teams should account for its Windows agent requirement for network testing and request pricing for their engagement or deployment needs.

Questions

How is PENTRA deployed?

It is deployed on-premises, requires no cloud connectivity, and is described as fully air-gappable.

What platforms does PENTRA support?

PENTRA is listed for self-hosted, web, and Windows environments.

What does PENTRA test?

Coverage includes internal networks and Active Directory, web applications, mobile applications, and APIs.

Does PENTRA provide reports?

Yes. It creates PDF and Microsoft Word reports with summaries, metrics, screenshots, and framework mappings.

How does network-agent setup work?

The Network module requires an agent on a customer-provided Windows initial-access machine. Other listed modules run from the C2 server.

Is managed testing available?

Yes. Reacts offers fully managed penetration testing delivered by certified security engineers, with international and remote engagement availability.

Facts from PENTRA's own pages

Agent requirement: The network module uses a Windows agent on a customer-provided initial-access machine; the web, mobile, API, and Purple modules run from the C2 server. · pentrasecurity.io, 8 Oct 2026
Availability: The site says engagements are supported internationally, with remote delivery available across all regions. · pentrasecurity.io, 8 Oct 2026
Coverage: The platform covers internal network and Active Directory, web applications, mobile applications, and APIs. · pentrasecurity.io, 8 Oct 2026
Deployment: PENTRA is deployed on-premises, requires no cloud connectivity, and is described as fully air-gappable. · pentrasecurity.io, 8 Oct 2026
Framework mappings: Reports cross-reference findings to NIST, PCI-DSS, and ISO 27001 controls. · pentrasecurity.io, 8 Oct 2026
Frameworks: The platform aligns network testing with MITRE ATT&CK, application testing with OWASP, and reports findings against NIST, PCI-DSS, and ISO 27001 controls. · pentrasecurity.io, 8 Oct 2026
Human validation: An engineer confirms exploitability, affected objects, severity, and evidence before a finding is recorded. · pentrasecurity.io, 8 Oct 2026
Intended users: The platform describes use by internal security teams, pentesters, Blue Teams, SOC analysts, administrators, and managed security providers. · pentrasecurity.io, 8 Oct 2026
Managed service: Reacts offers PENTRA as a fully managed penetration testing service as well as a platform for internal teams. · pentrasecurity.io, 8 Oct 2026
Network agent: The Network module requires an agent on a customer-provided Windows machine; the Web, Mobile, API, and Purple modules run from the C2 server directly. · pentrasecurity.io, 8 Oct 2026
Purple Team: PT++ supports simultaneous Red Team execution and Blue Team detection validation in the same engagement. · pentrasecurity.io, 8 Oct 2026
Purpose: PENTRA is a penetration testing and vulnerability management platform that executes MITRE ATT&CK techniques and OWASP test cases at the individual technique level. · pentrasecurity.io, 8 Oct 2026
Remediation: PENTRA tracks findings through mitigation and retesting, recording new evidence when an engineer checks whether a fix worked. · pentrasecurity.io, 8 Oct 2026
Reports: The platform generates PDF and Microsoft Word reports with executive summaries, security and detection metrics, evidence screenshots, and framework mappings. · pentrasecurity.io, 8 Oct 2026
Scope tracking: Its Open Points tracker requires in-scope techniques to be executed and validated before an engagement can close. · pentrasecurity.io, 8 Oct 2026
Security controls: Agent-to-server communication is TLS-encrypted, each agent has a unique certificate, and execution output is stored in private, non-web-accessible storage. · pentrasecurity.io, 8 Oct 2026
Support and delivery: Reacts offers fully managed penetration testing delivered by certified security engineers using PENTRA, with international and remote engagement availability. · pentrasecurity.io, 8 Oct 2026
Threat research: The PENTRA Security Lab develops attack content including updated MITRE ATT&CK techniques, OWASP test cases, AI-generated payloads, and detection use cases. · pentrasecurity.io, 8 Oct 2026
Validation: Security engineers validate results, Blue Teams mark detections, and findings include proof of execution. · pentrasecurity.io, 8 Oct 2026

Where PENTRA stands on Freedom251

Penetration Testing Software#32 of 34