Attestra — From Findings to Signed Attestation

The problem

Security testing produces evidence. Audits need proof.

Teams already run scanners and pentests. The hard part is turning scattered results into prioritized work and audit-ready attestation.

Findings scattered across tools

ZAP, Nuclei, Trivy, Semgrep and other SARIF producers each ship their own formats. The same issue often appears more than once.

Hard to prioritize

CVSS alone does not reflect exploitability in the wild or how critical the affected asset is to the business.

Compliance mapping is manual

Linking findings to PCI DSS, ISO 27001 or SOC 2 requirements is slow, inconsistent, and difficult to defend in audit.

Reporting takes too long

Technical detail for testers, executive summaries for leadership, and framework evidence packs for assessors are rebuilt by hand.

Scope and authorization gaps

Without a clear signed authorization and in-scope assets, imports and retests are hard to justify under ISO A.8.34-style controls.

Weak evidence integrity

Stakeholders need to know raw imports, evidence files and reports have not been silently altered after the engagement.

The Attestra solution

Import. Normalize. Attest.

Attestra is an import-and-report VAPT evidence platform. Testers run scanners under client authorization; Attestra turns those results into ranked findings, proposed control status, and signed reports.

1

Engage

Create tenant & engagement with target frameworks

2

Authorize

Record signed authorization; imports blocked without it

3

Scope

Add assets with criticality, exposure & PCI CDE flags

4

Import

Ingest scanner result files into one finding schema

5

Prioritize

Risk-rank, triage, validate, track SLA & retests

6

Map

Propose PCI / ISO / SOC 2 status; assessor confirms

7

Report

Generate, QA, sign and verify frozen HTML reports

Attestra does not attack targets on its own. Result files are imported (or produced by scoped runner dispatch under engagement authorization), then treated as evidence.

Features & capabilities

Built for evidence you can defend

Capabilities below reflect implemented Attestra functionality — not a wishlist.

Engagement & authorization

Engagements

Tenants and engagements for VA, PT, VAPT, retest or continuous work, with test windows and selected frameworks.

Benefit: one place for client context and audit cycle scope.

Authorization gate

Signed authorization is hashed and stored write-once. Imports are refused when no currently valid authorization exists.

Benefit: clear proof that testing stayed inside authorized bounds.

Scoped assets

Record targets with criticality (1–5), internet/internal exposure, and PCI CDE flags for framework-aware evaluation.

Benefit: risk and PCI scoping follow the asset, not the spreadsheet.

Import & findings

Multi-tool import

OWASP ZAP JSON, Nuclei JSONL, Trivy JSON (vulns & misconfigs), and any SARIF 2.1 (Semgrep, CodeQL, Checkov, Gitleaks and others).

Benefit: keep the tools your team trusts; Attestra normalizes the output.

Fingerprint de-duplication

One finding schema keyed on CWE / CVE / location. Cross-tool and cross-run duplicates merge by fingerprint.

Benefit: less noise, clearer remediation queues.

Risk prioritization

Risk combines CVSS, FIRST EPSS, CISA KEV, asset criticality and exposure. Reports still show CVSS as the severity of record.

Benefit: work the issues that matter first.

Finding lifecycle

Statuses from new through triaged, validated, fixed and retest_passed — plus false_positive and risk_accepted (reason required). Fixed findings that reappear reopen.

Benefit: remediation progress is explicit and auditable.

SLA tracking

Due dates such as critical findings within 30 days (aligned to PCI 6.3.3 expectations), with ageing and SLA breach reporting.

Benefit: overdue risk is visible before audit day.

Evidence store

Uploaded artifacts are masked where needed, SHA-256 hashed, content-addressed and stored write-once.

Benefit: every claim can point back to a hashed artifact.

Compliance & reporting

Hub-and-spoke mapping

Findings map once to a control objective via CWE, then fan out to PCI DSS 4.0.1, ISO/IEC 27001:2022 and SOC 2.

Benefit: add frameworks through the mapping library, not one-off scripts.

Propose, then confirm

The engine proposes control status; a named assessor confirms with rationale. No exceptions is distinct from met.

Benefit: absence of findings is never mistaken for proof a control is in place.

Signed reports

Versioned HTML reports frozen by SHA-256, moved through submit → QA → sign, then signed with Ed25519 (HMAC fallback).

Benefit: deliverables that can be verified after they leave the platform.

Operations & interfaces

Web, API & CLI

Server-rendered dashboard, REST API with OpenAPI docs, and a CLI that share the same business rules and audit trail.

Benefit: humans and automation use one trusted path.

Hash-chained audit log

Append-only audit events with tamper verification for business writes across the engagement lifecycle.

Benefit: reconstruct who did what, and prove the chain still holds.

Portal & Trust Center

Client portal and auditor views for engagement visibility, plus a public Trust Center surface for controlled external access.

Benefit: share status without emailing sensitive binders.

Advantages

What customers gain in practice

Practical outcomes supported by the product — without promising zero risk or guaranteed certification.

One normalized view

Cross-tool findings land in a single schema with de-duplication, so teams stop reconciling three exports by hand.

Clearer prioritization

EPSS, KEV and asset context sit beside CVSS so remediation queues reflect exploitability and business impact.

Faster compliance storytelling

Proposed control status with assessor confirmation shortens the path from test evidence to framework evidence packs.

Less manual reporting

Technical, executive and compliance deliverables generate from the same engagement data, then freeze and sign.

Better handoffs

Testers, reviewers, assessors and client viewers work from role-aware interfaces against the same findings.

Defensible integrity

Hashed imports, write-once evidence, four-eyes report workflow and a verifiable audit chain support external scrutiny.

Deliverables

What customers receive in reports

Attestra produces versioned HTML reports (with DOCX/PDF export), letters, and framework packs from live engagement data.

Technical

Technical VAPT report

Audience: security engineers, testers, remediation owners

Scope assets and signed authorization metadata
Imported tools, filenames and raw SHA-256 digests
Open findings with severity, risk score, CVSS, EPSS, KEV
Location, CWE/CVE, tools, validation, recommendations
Linked evidence artifacts with hashes

Executive

Executive summary

Audience: CISOs, business stakeholders, account leads

Open severity counts and top risks
Trend vs prior engagement for the same client
Compliance readiness roll-up by framework
Optional AI-assisted narrative only when human-approved

Compliance

Compliance evidence pack

Audience: assessors, QSAs, internal audit

Per-control status: met, no exceptions, partial, not met, not assessed
Proposed vs assessor-confirmed rationale
Finding references and mapping strength
Evidence index of authorizations, imports and finding artifacts

Additional

Letters, SoA, ageing & packs

Audience: closure / attestation stakeholders and auditors

ISO Statement of Applicability report
SLA ageing / breach report
Closure and attestation letters
Framework zip packs with SHA-256 manifest
SARIF and OSCAL assessment / POA&M exports

Sample layout · Executive summary structure

Executive summary: Q4 VAPT

VAPT engagement · open issues ranked for remediation · control readiness proposed then confirmed

2Critical

5High

11Medium

4Low

Illustrative counts only — not a live customer report. Real reports freeze HTML by SHA-256 and require distinct author, QA and signer before signature.

How it fits

Where Attestra sits in your workflow

Attestra coordinates evidence around testing you already perform — it does not replace remediation owners or the assessor’s judgment.

Before testing

Create the engagement, upload the signed authorization, and register in-scope assets (including CDE flags when PCI is in play).

During testing

Run scanners under that authorization. Import result files (or use scoped runner dispatch). Enrich with KEV/EPSS and triage findings with named validation.

After testing

Evaluate compliance proposals, confirm controls as assessor, generate reports, complete four-eyes QA and signing, then share portal or Trust Center access as needed.

Human review stays required

False positives, risk acceptance, control confirmation and report QA/sign-off are deliberate human steps — not silent automation.

Who benefits

Built for the people who ship and review security evidence

Security engineers & VAPT testers

Import multi-tool results, de-duplicate, validate findings, attach evidence and drive lifecycle status without rebuilding trackers.

Assessors & compliance leads

Review proposed control status, confirm with rationale, and export framework evidence packs tied to hashed artifacts.

Security leaders & CISOs

Read executive summaries, severity trends and readiness roll-ups that are grounded in the same data as the technical report.

Client viewers & auditors

Use portal and auditor views (and Trust Center access where enabled) to follow engagement status without opaque email threads.

DevSecOps & platform teams

Drive imports and checks through the REST API and CLI against the same audited services layer as the dashboard.

Report QA & signatories

Enforce distinct author / QA / signer workflow before Ed25519 (or HMAC) signatures are applied to frozen HTML.

See Attestra on your next engagement

Talk with AntHive Tech about a demo, a pilot engagement, or how Attestra fits your application-security and audit workflow.

Request a Demo Explore Anthive

General: info@anthive.tech · Support: support@anthive.tech