Run more engagements.
Ship the same quality every time.

One approved version of every finding.

Each library finding holds a variant per assessment type and language, each with its own severity and its own review. An approved variant keeps serving engagements while a new draft is edited, and its version history can be restored.

When a tester improves a finding on an engagement, they can push the change back to the library section by section, once the engagement finding has cleared QA.

• A Stale badge on variants written against an older field configuration
• Scanner check codes and CVEs mapped to library findings, so imports suggest the right one
• The whole library exports and re-imports as JSON, with a preview and a rollback

Review that cannot be skipped.

Findings and briefs move from draft to in review to pending approval to approved. The reviewer and the approver must be different people, and nobody can approve their own work.

The review queue ages. Items turn amber, then red, at thresholds you set, and each reviewer gets a daily digest of what is overdue.

• Track changes attributes every insertion, deletion, formatting change and caption edit
• Approval is blocked while any tracked change or comment is unresolved
• Approved findings and briefs become read-only

Your template. Your languages.

Reports render from your own Word templates, including charts fed by engagement data. When you upload a template, Neuron checks its fonts and lists what will be substituted in the PDF. The same data also exports to Excel and Markdown.

Set a default output language and enable more. Each brief is one section with a version per language, so one template serves every language you deliver in.

Scored the way your clients ask.

CVSS v4.0 with Threat, Environmental and Supplemental metrics, the full sixteen-factor OWASP Risk Rating, and MITRE ATT&CK mapping. Twelve custom field types cover whatever else your reports need.

Delivery that leaves a record.

The Delivery Portal runs as a separate service that can sit in your DMZ, with no database and no encryption keys of its own. Client users sign in with MFA or their own SSO and see only what has been released to them.

Every sign-in, view and download is logged per client, and the log exports to CSV. Clients request retests from the portal, and you accept or decline with a reply they can read.