Your last five engagements, searchable.

Recognise what you saw before. Keep client data separate. Name the source of every finding.

In plain words

For security testers: at a new client you find something you have seen somewhere before — but in which report was it?

Provenize searches your own old reports, on your own laptop, and names the report and the page. Data from different clients stays separated, so your confidentiality agreements stay intact.

Three pains from practice
  1. The repeat findingYou reported this misconfiguration for a different client last year. Nothing in your toolchain remembers that.search across engagements, with the source named
  2. The NDA clampYou want AI help, and the material is under NDA. Pasting the scope into a hosted tool is the one thing you cannot do.your files never leave your computer
  3. Report proofA client disputes a finding. You need the evidence record, not your memory of it.every claim points at the record that produced it

In an engagement

What it does while you work.

  • Access limited to one engagementBuiltroles scoped to one engagement
  • Import findingsPlannedreads findings from your scanners — never runs them
  • Answers with their sourceBuiltdocument, page, match score
  • Recognise it across engagementsBuiltrecognise what you already reported
  • Evidence linked in a chainBuiltevery step becomes a line in the log
  • The search index stays on your computerBuiltthe index never leaves your computer
  • Retention-hold roleBuiltblocks erasure while retention applies
  • Separate checking app for othersPlannedchecking currently needs our software
Agreements with the client

Provenize reads findings and documents. It does not scan, exploit, or execute anything — by design, not by configuration.

One-pager for pentest teams →Check the proof yourself →See the concept app →Score your own practice →
Frequently asked questions

Can pentest findings go into an AI tool?

Client findings are almost always under NDA. Pasting them into a cloud AI means sharing them with a third party — often already a breach of contract. Running locally solves that: the report stays on your machine.

What does AI give me in pentesting?

Recognising what you saw before: making old reports searchable, so last year's finding surfaces immediately — with the exact passage, not a vague "looks similar".

Can I check what the AI did with my reports?

Yes — every search and every document read is written into a log you can verify yourself has not been altered. The same requirement you would put to a client.

From the blog

Can an audit log be tampered with? The four gaps in ours — the same honesty you would put in a report, applied to our own proof model. And: is your data really gone at an AI vendor?

Break it before we ship it.

Become a design partner