Question 1

What is PentaTrail CTEM/ASM?

Accepted Answer

PentaTrail is a CTEM (Continuous Threat Exposure Management) platform that automatically discovers and monitors your external attack surface.

Starting from the domains your organization owns, it continuously scans externally exposed assets and vulnerabilities from an attacker's perspective.

Key features:

Automated discovery of hosts, IPs, ports, technology stacks, URLs, and cloud buckets
Detection of known vulnerabilities that may apply
Continuous monitoring of assets (diff tracking)
Risk rating (TER: S/A/B/C/D)

Question 2

Can I use PentaTrail for free? What can I do with it?

Accepted Answer

Yes — PentaTrail ASM is free. No credit card required. Register a domain and we start showing what is exposed from the outside (up to 1 domain). What PentaTrail ASM includes: Automated discovery and inventory of external assets; Detection of known vulnerabilities that may apply. When you need to know what to address first, why, and the specific steps to fix it, you can switch to PentaTrail CTEM. Staying on PentaTrail ASM never incurs a charge.

Question 3

How long does setup take?

Accepted Answer

No software installation or network configuration is required. Create an account and register the domain you want to monitor, and observation begins. How to get started: Agree to the Terms of Service and create an account; Register the domain you want to monitor; Observation of assets visible from the outside begins. Assets and vulnerabilities that are found appear in your dashboard as observation progresses.

Question 4

How do I register a domain for monitoring?

Accepted Answer

Enter a domain or URL, review how PentaTrail organizes it into the origin domain that monitoring starts from, and register it. Enter a domain, URL, or subdomain; Review the origin domain PentaTrail organized it into; Once registered, observation of what is visible from the outside begins.

Question 5

How is this different from a free single-domain scanning tool?

Accepted Answer

Free single-domain scanning tools mainly run a one-time check against the single URL you enter. PentaTrail automatically discovers subdomains, IPs, ports, and technology stacks under your registered origin domain, then continuously monitors and re-scans them. Discovery scope — A single-domain scan only covers the URL you enter. PentaTrail automatically discovers related assets under your origin domain, including ones you did not know about; Continuity — A single-domain scan is a one-off check you run manually each time. PentaTrail observes continuously and keeps detecting new assets and known vulnerabilities that may apply; Prioritization — A single-domain scan typically just lists what it finds. PentaTrail shows what to address first, using the TER risk rating (five levels: S, A, B, C, D) and AI remediation guidance.

Question 6

How can I contact support?

Accepted Answer

For product questions, technical consultations, or contract inquiries, please feel free to contact us. Contact us here

Question 7

What types of assets are discovered?

Accepted Answer

PentaTrail automatically discovers and catalogs assets across 7 categories: Hosts — Subdomains and related hostnames; IP Addresses — Resolved IP addresses; Ports & Services — Open ports and running services; Technology Stacks — Web servers, frameworks, CMS, and more; URLs — Web application endpoints; Cloud Buckets — Cloud storage such as S3; WHOIS Information — Domain registration data.

Question 8

Are there any monitoring limitations?

Accepted Answer

PentaTrail monitors assets that are reachable from the public internet. The following are outside the monitoring scope: Internal networks — Servers behind firewalls and intranets; VPN-only hosts — Environments not resolvable or reachable from the internet; Authenticated application internals — Pages and APIs behind a login. This follows the CTEM design principle of evaluating risk from the same external perspective an attacker has.

Question 9

Are on-premises assets (internal network) also monitored?

Accepted Answer

No — on-premises assets that are not reachable from the public internet are outside the monitoring scope. Because PentaTrail is CTEM that evaluates risk from the same external perspective an attacker has, the following are not monitored: On-premises servers and intranets behind a firewall; VPN-only hosts; Environments not resolvable or reachable from the internet. However, if an on-premises asset has a public IP and is reachable from the outside, it is automatically discovered and monitored as part of your monitored domain.

Question 10

What vulnerabilities can you detect? Which vulnerability data sources do you use?

Accepted Answer

Detection centers on web application vulnerabilities and SSL/TLS misconfigurations, cross-referencing detected technology stack versions against multiple vulnerability databases. Vulnerability data sources: NVD (CVE) — Vulnerability data published by the U.S. National Vulnerability Database; EPSS — A score predicting the probability that a vulnerability will actually be exploited; KEV — The catalog of vulnerabilities with confirmed real-world exploitation; Linux distribution security advisories — Advisories issued by distributions such as Debian, Ubuntu, and RHEL. By checking whether patches have been backported, we reduce false positives that version numbers alone cannot rule out.

Question 11

How is vulnerability priority determined?

Accepted Answer

Beyond CVSS severity, PentaTrail combines public threat intelligence with its own observation evidence to set the order in which to respond. What we mainly look at: CVSS — The severity of the vulnerability itself; EPSS / KEV — The predicted likelihood of exploitation, and whether exploitation has actually been confirmed; Observation evidence — Whether the finding is corroborated by multiple sources; Asset importance — An initial value judged by AI, which you can change; TER — Technical risk and asset importance are combined using a published table, and the risk is shown in five levels: S, A, B, C, D

Question 12

How does PentaTrail use AI?

Accepted Answer

AI is used to show concrete ways to fix the problems that are detected. AI remediation guidance: It summarizes the target, why action is needed, and the concrete fix. Asset discovery itself is based on technical observation such as DNS and certificate data.

Question 13

Are there notification and alerting features?

Accepted Answer

On PentaTrail CTEM, you can review changes that need action and AI remediation guidance from your notifications. Notifications have read/unread states, and opening an item takes you to the related content. PentaTrail ASM does not show product notifications; service announcements such as contract or incident notices are handled separately.

Question 14

Can I integrate PentaTrail with other tools?

Accepted Answer

PentaTrail provides an MCP (Model Context Protocol) server. An AI tool you have approved can read your PentaTrail assets, vulnerabilities, and priorities, and change what is monitored and excluded. One endpoint (https://api.pentatrail.co/mcp) — nothing secret to store on your side; You approve the connection in your browser, on a screen that lists what it can actually do; Approved connections can be revoked at any time from the admin console; Covers reading (assets, vulnerabilities, priorities) and changing (monitoring targets, exclusions). See the MCP server documentation for details. We do not offer a public REST API for customers.

Question 15

How is this different from a manual vulnerability assessment (penetration test)?

Accepted Answer

A manual penetration test is a point-in-time assessment in which experts perform deep, hands-on intrusion testing. PentaTrail instead automates the work from discovering your external attack surface through detecting vulnerabilities, prioritizing them, and showing how to fix them, and repeats it continuously — a continuous assessment rather than a point-in-time one. Frequency — Manual assessments are typically run about once a year. PentaTrail observes continuously, detecting asset changes and known vulnerabilities that may apply; Scope — Manual assessments examine a predefined scope in depth. PentaTrail automatically discovers assets under your monitored domains, including ones you did not know about. The two are complementary, not substitutes. Keeping continuous visibility of your attack surface with PentaTrail while adding manual assessments for critical systems is an effective approach.

Question 16

Where is my data stored, and how is it protected?

Accepted Answer

All data is stored on cloud infrastructure in Japan and is encrypted both in transit and at rest. Security measures: Encryption in transit — All communication is encrypted with TLS 1.2 or later; Encryption at rest — The database is encrypted with AES-256; Access control — Row Level Security (RLS) strictly separates data per contract; Authentication — Passwordless passkey (WebAuthn/FIDO2) authentication, resistant to phishing; Key management — Vault-based. Your scan results and asset information cannot be accessed from any other contract's data on the same platform.

Question 17

Can my team use PentaTrail with role-based access?

Accepted Answer

Access is managed with three roles: Contract Owner, User Administrator, and User. Contract Owner — Manages the contract, plan, and payment details, and holds all permissions; User Administrator — Invites and removes users, and manages team members; User — Views assets and vulnerabilities.

Question 18

Can PentaTrail help with compliance?

Accepted Answer

You can use it to keep track of your externally exposed assets and as material to explain them in audits and risk assessments. Asset inventory — Continuously organizes the assets visible from the outside; Risk level — Shows what to address first, based on vulnerabilities and observation evidence; Observation history — Shows what was found when, and how it changed afterwards. It does not guarantee conformity with any specific certification or audit, but it can serve as evidence to explain your external attack surface.

Question 19

What are the pricing plans?

Accepted Answer

For pricing details, please see the Pricing page.

Question 20

What are the contract terms?

Accepted Answer

PentaTrail CTEM is a monthly subscription with no minimum contract period. Billing cycle: Renews monthly from your application date; Standard payment method: Credit card; Bank transfer / invoice payment: Available after review by our team; Additional domains / additional users: Change the quantity from the contract management screen; Cancellation / changing the payment method: To cancel, use the “Contract & billing” page. To change your payment method, open the Customer Portal from that page.; For details of the service and terms of use, see our Terms of Service

Question 21

Do you accept bank transfer or invoice payment?

Accepted Answer

Our standard payment method is credit card. Bank transfer and invoice payment are available after review by our team. In either case, billing is managed through Stripe, so you can pay securely.

Frequently Asked Questions

Key features:

What PentaTrail ASM includes:

How to get started:

Still have questions?