Flint scopes, prices and plans the work with your client. Slate runs the engagement, issues the reviewed report and gives your client their own client portal. Take either on its own; use both and nothing is typed twice.
What your project managers see in Flint: every engagement, its testers and its dates on one plan.
What your client sees in Slate's client portal: where they stand in a sentence, then the figures behind it.
Three of the tools we build for our own engagements are our main products. Flint scopes and plans the work with your client. Slate runs the engagement and delivers the report. Striker AI, coming soon, will bring AI-assisted and agentic testing. Flint and Slate are each licensed and priced on their own; connect them and nothing is typed twice.
Available now
Available now
Coming soonFlint and Slate are licensed separately and complete on their own. Connected, they share one record: each step shows where it happens, and every arrow is a hand-off nobody has to type.
| Step | Each on its own | Connected |
|---|---|---|
| Scoping | Flint: the client scopes and signs online. Slate: you enter the scope. | Slate starts from the scope the client signed in Flint. |
| Opening the engagement | Typed in from the statement of work. | Client, scope, segments, dates and testers filled in before you save. |
| Test accounts and rules of engagement | Copied across by hand. | Carried over from Flint's checklist and technical kick-off; passwords never cross. |
| Delivery status | Updated in each product. | Issuing the report marks the Flint project delivered. |
| The next test | Started again, or from an earlier scope. | Requested in the client portal; it starts in Flint in the same series. |
PenTest Hub has delivered penetration tests and red team engagements since 2017. Flint and Slate are the tools our own testers and project managers use on those engagements, and our testers already use Striker AI there too. What you license is what we use.
Flint and Slate are priced on their own. Slate comes in three editions, for three kinds of team; Flint has one price per user and follows the edition you choose. A user is anyone on your team with a login.
For in-house security teams at product companies, and testing companies that do not need white-label.
For security companies whose clients should see only their brand: the client portal, every email and your own domain carry your name and logo.
For organisations that need strict control: in our cloud or on your own server, connected or air-gapped.
Every edition starts with a 30-minute call; your instance is ready within two weeks of signing.
Use it on its own or alongside Slate. Each product counts its own users; your clients and the colleagues they hand sections to never count.
Minimum users and white-label follow your edition: none on Essential, 5 on Professional, 10 on Enterprise. Cloud version on every edition, Server version on Enterprise. The Board view, management reports and the activity log are available as add-ons. Client reports are included. One Partner is included; more Partners, for regions, teams or subsidiaries, are available as an add-on.
Billed monthly, excluding VAT, with everyone using both products in the last two examples. Yearly and 3-year terms cost less; your clients are never counted.
Every feature, edition by edition: Slate and Flint.
The same products either way. Most companies take the Cloud version; companies whose policy keeps data in-house take the Server version, part of the Enterprise edition.
Our own testers already use Striker AI on PenTest Hub's engagements; we are now making it production-ready for your team.
PenTest Project is the software arm of PenTest Hub, a penetration testing and red teaming company founded in 2017. The tools we build and use on our own engagements are made available here to other testing companies and in-house security teams. Three of them are our main products: Flint for scoping and project management, Slate for engagements, reporting and the client portal, and Striker AI for AI-assisted and agentic testing, coming soon. Flint and Slate are each licensed separately and work on their own; together they share one record, from the client's first scoping answer to the signed-off retest.
Yes. Each product is licensed separately and complete without the other: Flint is a full scoping and project management tool, Slate a full engagement, reporting and client portal platform. You can add the other one later and connect them.
One record from the client's first answer to the signed-off retest. A client asks for a test in Slate's client portal and scopes it in Flint. Opening the engagement in Slate fills in the client, scope, dates, testers, test accounts (never their passwords) and rules of engagement. Issuing the report marks the Flint project delivered, and the next test or retest starts in Flint in the same series.
Each name says what the product does in an engagement. Flint strikes the spark that starts the work. Slate keeps the record, set in stone. Striker AI will strike first, before an attacker does.
AI and automation run through all three products, and a person approves what matters. In Flint, AI Wingman briefs you, looks things up and drafts statements of work and invoices, acting only after you confirm; it is included in Flint's price and uses your own AI provider key. In Slate, AI Assist drafts write-ups and summaries with your own key. Striker AI, coming soon, will add AI-assisted and agentic testing. There is no per-token bill from us.
Penetration testing companies, security consultancies and in-house security teams. Testers and project managers are licensed; the clients who read the reports are not.
Anyone on your team who signs in, including, in Flint, the logins of every Partner. Flint and Slate each count their own users. Your clients never pay and never count: not when they scope or sign in Flint, and not in Slate's client portal.
Much is configurable without us: report templates, covers, colours and fonts in every edition and, on Professional and Enterprise, your own brand on every email and the client portal. Beyond that, we build it as custom development at €650 a day, with twelve months' exclusivity on the features you fund; Enterprise includes three development days a year.
Nothing is deleted and nothing is held back. On the Server version a grace period follows the end of the term; after it the instance turns read-only, so everything can still be read and exported until the licence is renewed.
On the Cloud version, on your own dedicated instance in the region you choose, EU by default, exported to you on request. On the Server version it never leaves your environment, and we access it only when you grant it for support.
Yes, in every edition of Flint and Slate. Your team, and your clients' users in the client portal, sign in with Microsoft Entra ID, Google Workspace or any OpenID Connect provider. Anyone who signs in with a password can add an authenticator app code, and your administrators can require it.
As signed, versioned releases with security patches. On the Cloud version we apply them. On the Server version Flint and Slate can check for a new release while your licence covers updates, and your administrator runs the upgrade; networks without internet access import the release list as a file.
A 30-minute call to settle the products, users, edition and where it runs, then your instance is ready within two weeks of signing. On the Server version your team installs it with our installer and your activation key, or we install it for you.
Yes. On Professional and Enterprise, assisted onboarding includes migrating your findings library from Word, Excel or the tool you use today; on Essential we do it as custom development. A self-service import from Excel and CSV is coming soon, and Nessus results (CSV) can be imported today.
Choose an edition and we provision your instance, or book a demo first and we walk you through it with sample data.
Not ready for a call? Email us at info [at] pentest-hub.com.
