Question 1

What is PentaTrail?

Accepted Answer

PentaTrail is a CTEM (Continuous Threat Exposure Management) platform that automatically discovers and monitors your external attack surface.

Starting from the domains your organization owns, it continuously scans externally exposed assets and vulnerabilities from an attacker's perspective.

Key Features:

Automated discovery of hosts, IPs, ports, technology stacks, URLs, and cloud buckets
Web application and SSL/TLS vulnerability scanning
Real-time detection of asset changes
Risk quantification via proprietary scoring (TDL/TER)

Question 2

What is CTEM and how does PentaTrail implement it?

Accepted Answer

CTEM (Continuous Threat Exposure Management) is a framework for continuously identifying, assessing, and remediating external threats.

PentaTrail covers the full CTEM lifecycle through 5 integrated stages:

Scoping — Register domains and define your monitoring scope
Discovery — Automatically discover subdomains, IPs, ports, technologies, and URLs
Prioritization — Score each finding using TDL/TER metrics combining CVSS, EPSS, KEV, and business impact
Validation — Validate exploitability with AI-powered deep scans
Mobilization — Assign remediation tasks, track status, and generate reports

Of these five stages, Scoping and Discovery — plus viewing the AI remediation guidance in Mobilization — are included in the ASM plan. Prioritization (asset weighting and grouping), Validation, and Mobilization's remediation-task workflow and executive reporting are added in the CTEM plan. See "What is the difference between ASM and CTEM?" for details.

Question 3

How do I get started?

Accepted Answer

Agree to Terms of Service & Create an Account — Sign up with Google OAuth, or with your email address (we send a passwordless sign-in link — no password required); Register a Passkey — During initial setup, register a passkey (your device biometrics or screen lock, or a security key) as your sign-in credential. No authenticator app or QR code is needed; Register Your Domain — Add the domain you want to monitor from the dashboard; Verify Domain Ownership — Add a DNS TXT record to confirm ownership. Propagation typically takes a few minutes to a few hours; Automatic Scanning Begins — Once verification is complete, asset discovery starts automatically. Note: Free email addresses (gmail.com, yahoo.com, etc.) cannot be used for registration.

Question 4

Is there a free trial?

Accepted Answer

Yes. PentaTrail offers a 14-day free trial after account creation — credit card registration only, no upfront charges.

What's included in the trial:

Up to 3 origin domains
Full asset discovery (hosts, IPs, ports, technologies, URLs)
Complete dashboard access including risk scoring

Deep scanning is available as an add-on after subscribing to a paid plan.

Question 5

How long does setup take?

Accepted Answer

You can start monitoring in as little as 5 minutes. No software installation or network configuration required. Agree to Terms of Service & create an account; Register the domain you want to monitor; Asset discovery begins automatically. Discovery results appear in your dashboard within a few hours. If you want deep scanning, DNS TXT domain ownership verification is required as a separate step.

Question 6

Will scanning affect my production systems?

Accepted Answer

No. PentaTrail uses non-intrusive, external observation — the same perspective an attacker would have. No agents or internal network access required; Scans use only public information gathering (HTTP/HTTPS requests, DNS lookups); Server load is comparable to normal web browsing; No write operations or data modifications are performed. Even during the Validation phase, exploitability is confirmed using non-destructive techniques.

Question 7

How do I register a domain for monitoring?

Accepted Answer

Register origin domains from the dashboard:

Add a domain from "Domain Management" in the dashboard
Verify domain ownership via DNS TXT record
Asset discovery begins automatically after verification

DNS verification typically takes a few minutes to a few hours, depending on DNS propagation.

Question 8

What is the difference between ASM and CTEM?

Accepted Answer

ASM (Attack Surface Management) covers discovery, continuous monitoring, and risk rating of your external attack surface. CTEM (Continuous Threat Exposure Management) is the broader continuous risk management framework that includes ASM.

ASM — Discovery of externally exposed assets, continuous monitoring of changes, and access to AI remediation guidance
CTEM — Everything in ASM, plus active AI-driven validation (non-destructive confirmation of real-world exploitability), remediation task management with owners and due dates, business-impact grouping and responsibility assignment, and executive summary reporting

CTEM is the framework that runs the full 5 stages proposed by Gartner (Scoping, Discovery, Prioritization, Validation, and Mobilization), and ASM covers Scoping, Discovery, and part of Mobilization (viewing the AI remediation guidance) within it.

Question 9

How is this different from a free single-domain scanning tool?

Accepted Answer

Free single-domain scanning tools typically run a one-time check against the single URL you enter. PentaTrail automatically discovers subdomains, IPs, ports, and technology stacks under your registered origin domain, then continuously monitors and re-scans them. Discovery scope — A single-domain scan only covers the URL you enter. PentaTrail automatically discovers related assets under your origin domain, surfacing assets you were not previously aware of. Continuity — A single-domain scan is a one-time check you run manually. PentaTrail runs continuously, detecting new assets and newly disclosed vulnerabilities on an ongoing basis. Prioritization — A single-domain scan typically just lists what it finds. PentaTrail adds proprietary risk scoring (TDL/BI score) and AI remediation guidance to show what to fix first.

Question 10

What types of assets are discovered?

Accepted Answer

PentaTrail automatically discovers and catalogs assets across 7 categories: Hosts — Subdomains and related hostnames; IP Addresses — Resolved IP addresses; Ports & Services — Open ports and running services; Technology Stacks — Web servers, frameworks, CMS, and more; URLs — Web application endpoints; Cloud Buckets — Cloud storage such as S3; WHOIS Information — Domain registration data.

Question 11

How does risk scoring work?

Accepted Answer

PentaTrail uses two proprietary metrics to quantify risk: TDL (Threat Discovery Level): Combines multiple threat intelligence signals per finding: CVSS — Vulnerability severity score (0–10); EPSS — Probability of exploitation in the wild (0–1); KEV — Whether it appears in the Known Exploited Vulnerabilities catalog; Evidence Grade — Detection confidence (A=high, D=low). Higher when corroborated by multiple sources and active verification. TER (Threat Exposure Risk): Combines TDL with a business impact score to produce an overall S/A/B/C/D risk band, enabling prioritization aligned with your organization's risk profile.

Question 12

How does AI-powered deep scanning work?

Accepted Answer

Deep scans go beyond passive detection to actively verify whether a vulnerability is exploitable in your specific environment. AI-Driven Verification Pipeline: Research & Generation — AI analyzes CVE details and vendor context, then generates a verification template; AI Review — A separate AI reviewer evaluates the template for detection quality, safety, and correctness, assigning a confidence score; Active Verification — Templates meeting the confidence threshold are executed against your actual environment using Nuclei; Results & Summary — AI generates a human-readable summary of the results, including confirmation status and remediation guidance. This multi-stage approach significantly reduces false positives, letting your team focus on vulnerabilities that actually require action.

Question 13

Can I integrate PentaTrail with other tools?

Accepted Answer

PentaTrail provides a REST API and an MCP (Model Context Protocol) server for integrating CTEM data into your existing workflows and AI tools. REST API: API key authentication for secure access; Query vulnerabilities, assets, and risk scores; IP allowlisting and rate limiting supported. MCP Server (@pentatrail/mcp-server): Published as an npm package; Query CTEM data in natural language from Claude Desktop and other AI tools; Uses the same data source as the REST API. See the API documentation for details.

Question 14

Are there notification and alerting features?

Accepted Answer

The dashboard notification bell keeps you informed of important changes and recommended actions in real time. Notification types: Weekly Summary — A digest of asset changes and newly detected vulnerabilities from the past week; AI remediation guidance — Recommendations for newly detected vulnerabilities. Notifications support read/unread tracking so you can quickly identify items that need attention.

Question 15

Are there any monitoring limitations?

Accepted Answer

PentaTrail monitors assets that are reachable from the public internet. The following are outside the monitoring scope: Internal networks — Servers behind firewalls and intranets; VPN-only hosts — Environments not resolvable or reachable from the internet; Authenticated application internals — Pages and APIs behind login walls. This is by design — CTEM evaluates risk from the same external perspective an attacker would have.

Question 16

What vulnerabilities can you detect? Which vulnerability data sources do you use?

Accepted Answer

Detection centers on web application vulnerabilities and SSL/TLS misconfigurations, cross-referencing detected technology stack versions against multiple vulnerability databases. Vulnerability data sources: NVD (CVE) — Vulnerability data published by the U.S. National Vulnerability Database; EPSS — A score predicting the probability that a vulnerability will actually be exploited; KEV — The catalog of vulnerabilities with confirmed real-world exploitation; Linux distro security advisories — Advisories published by distributions such as Debian, Ubuntu, and RHEL. These are cross-referenced against backported patches to reduce false positives that version numbers alone cannot resolve.

Question 17

Are on-premises assets (internal network) also monitored?

Accepted Answer

No — on-premises assets that are not reachable from the public internet are outside the monitoring scope. Because PentaTrail evaluates risk from the same external perspective an attacker would have, the following are not monitored: On-premises servers and intranets behind a firewall; VPN-only hosts; Environments not resolvable or reachable from the internet. However, if an on-premises asset has a public IP address and is reachable from the internet, it will be automatically discovered and monitored as part of your registered domain.

Question 18

How is this different from a manual vulnerability assessment (penetration test)?

Accepted Answer

A manual penetration test is a point-in-time exercise where experts perform deep, hands-on exploitation testing. PentaTrail instead automates discovery of your external attack surface, vulnerability detection, prioritization, and non-destructive AI verification, repeating the cycle continuously. Frequency — Manual assessments are typically run about once a year. PentaTrail runs continuously, detecting asset changes and new vulnerabilities on an ongoing basis. Scope — Manual assessments dig deep into a pre-defined scope. PentaTrail automatically discovers assets under your registered domain, including assets you were not previously aware of. Verification method — Manual assessments rely on hands-on exploitation by experts. PentaTrail performs automated verification using AI-generated, non-destructive verification code. The two are complementary, not interchangeable. Many teams use PentaTrail for continuous attack surface visibility while reserving manual assessments for critical systems.

Question 19

How is my data protected?

Accepted Answer

PentaTrail implements defense-in-depth across multiple layers: Data Isolation — Row Level Security (RLS) ensures each organization can only access its own data; Authentication — Passwordless passkey (WebAuthn/FIDO2) authentication with phishing resistance; Encryption — All communication encrypted via TLS; data encrypted at rest; Key Management — Vault-based secret management; Bot Protection — Cloudflare Turnstile on authentication flows.

Question 20

Can my team use PentaTrail with role-based access?

Accepted Answer

PentaTrail supports three roles for access management: Contract Owner — Full access including billing, plan management, and all permissions; User Administrator — Invite and remove team members, manage users; User — View assets and vulnerabilities, manage remediation status. Additionally, assets can be organized into groups with group-level visibility controls, allowing teams to scope access by department or responsibility area.

Question 21

Can PentaTrail help with compliance?

Accepted Answer

PentaTrail's continuous CTEM operations strengthen your organization's security governance through ongoing visibility and management of your external attack surface. Automated asset inventory — Continuously updated catalog of externally exposed assets; Risk quantification — Proprietary scoring that clearly prioritizes remediation; Remediation history — Full audit trail from detection through resolution; Weekly reports — Risk trend visualization suitable for executive reporting. These capabilities provide evidence for security audits and risk assessments.

Question 22

How does signing in and authentication work?

Accepted Answer

PentaTrail uses passwordless passkey (WebAuthn/FIDO2) authentication. It is resistant to phishing and eliminates the risk of reused or leaked passwords. During initial setup after account creation, you are prompted to register a passkey. Registration completes with your device biometrics (fingerprint or face), your screen lock, or a security key. No dedicated authenticator app or QR code scanning is required. Subsequent logins are a single tap with your registered passkey. Where passkeys are unavailable, you can also sign in with your Google account.

Question 23

What are the pricing plans?

Accepted Answer

For pricing details, please see Pricing page.

Question 24

Do you accept bank transfer or invoice payment?

Accepted Answer

Our standard payment method is credit card. Bank transfer and invoice payment are available after review by our team. All billing is managed through Stripe.

Question 25

How can I contact support?

Accepted Answer

For product questions, technical inquiries, or billing matters, please don't hesitate to reach out. Contact us here

Question 26

What are the contract terms?

Accepted Answer

PentaTrail is a monthly subscription with no minimum contract period. Billing cycle: Monthly, anchored to your signup date (renews on the same day each month); Credit card: Auto-billed monthly after the 14-day free trial; Bank transfer / invoice: Due within 30 days of invoice issuance (subject to approval); Mid-cycle changes: Pro-rated adjustments; Changes and cancellations available from the admin panel; For full terms and conditions, see our Terms of Service.

Frequently Asked Questions

Key Features:

What's included in the trial:

Still have questions?