From hardware capture to compliance proof — automatically. Drop your capture files into a self-hosted web UI, or drive it from the CLI. Works with every tool your team already uses.
You finish a physical engagement with badge clones, signal captures, and RF dumps. Now spend 4 hours turning them into a Word doc. Manually. While your client waits for findings that should have been machine-readable from the moment of capture.
Vaultprobe ingests your captures, fingerprints the hardware, maps every finding to ISO 27001 and NIS2, generates SHA-256 verified evidence objects, and produces a client-grade report. In seconds for a single capture; under a minute for a 30-file engagement. JSON output structured for GRC platform ingestion.
Two ways to drive the same engine, both self-hosted on your own infrastructure. A browser-based web UI for everyday use — drag in your capture files, add the engagement details, and download a PDF and OSCAL report — and a CLI for scripting and CI. An API key is required either way, and nothing leaves your network.
Use any physical pentest hardware on site — Flipper Zero, Proxmark3, Chameleon Ultra, WiFi Pineapple, Kismet, or Nmap. No changes to your current workflow. Vaultprobe reads whatever your tools produce.
Vendor fingerprinting across 31 hardware vendor entries. CVE matching. NIST vulnerability mapping. AI classification (when an Anthropic API key is configured) or a deterministic 3,800-line template classifier when no key is set. Chain of custody hashing. All automatic, all auditable.
ISO 27001, NIS2 and IEC 62443-mapped PDF report plus machine-readable evidence objects in JSON for GRC platform ingestion. Download it straight from the web UI, or generate it from the CLI; NIST OSCAL 1.1.2 Assessment Results JSON is available too (--format oscal). Defensible. Verifiable. Done.
Automatic identification of HID Global, FAAC, Lenel, ASSA ABLOY and 31 vendor entries spanning NFC, Sub-GHz and iButton categories — fingerprinted from raw capture data alone.
Version-aware CVE lookup plus NIST SP 800-116 citations for insecure-by-design cases with no CVE. No manual research. No missed vulnerabilities.
Every finding maps to ISO 27001 Annex A controls and NIS2 Article 21 obligations. Physical-access and serial/embedded findings — NFC/RFID badge cloning, iButton, Sub-GHz, and UART credential exposure and debug ports on industrial equipment — additionally map to IEC 62443-3-3 security requirements. Physical, IT and OT compliance evidence in a single report, defensible in any regulatory conversation.
Cryptographic hash per evidence file at ingest. Tamper-evident chain of custody embedded in every report. Re-verify with vaultprobe verify <evidence-id> --file <path> from the CLI. For text captures the verification is byte-for-byte; for binary captures a documented caveat applies — see the threat model.
Pineapple event logs including rogue-AP, evil-portal and deauth events, Kismet PMKID/handshake data, and Nmap network maps — all formatted as structured findings with compliance controls mapped.
Flipper Zero, Proxmark3, Chameleon, Pineapple, Kismet findings in a single client-grade report. Every hardware source labelled. One deliverable, complete picture.
When an Anthropic API key is configured, Claude generates per-finding narratives, attack scenarios, and remediation. A deterministic 3,800-line template classifier handles every finding type when no AI key is set, so the tool works offline.
Across 9 domains — Flipper & low-level hardware, Hak5 suite, Wi-Fi & wireless, AD post-exploitation, vulnerability scanners, OT/BMS, SDR & NFC depth, and cloud & cred-cracking. See full breakdown ↓
235 pages. 166 findings (incl. cloud + cred-cracking). Generated end-to-end by Vaultprobe from a fictional engagement (Northgate Asset Management plc). Download it and read every word — this is exactly what your client receives.
Every tool your physical-pentest team already carries. Drop the raw capture files in — Vaultprobe identifies the format, extracts findings, classifies risk and maps the controls.
Every dimension a CREST/OSCP physical pentester actually checks — captured as structured tri-state observations (yes / no / not-assessed) and rendered in the report as a colour-coded posture grid. Egress, alternate ingress, vertical bypass, visitor process, information hygiene, time-window — none of it gets forgotten in the write-up.
One YAML file rebrands every PDF: logo, primary & accent colours, classification banner, footer attribution, contact email, title template. Drop it in branding/ and pass --branding branding/your-firm.yaml on the CLI — same engine, different cover.
Same engine — two different brand profiles applied at render time.
firm_name Your company name on every cover & footerlogo_path SVG or PNG, rendered top-left of coverprimary_color Cover accent & section dividersaccent_color Severity bars & calloutscover_classification "Confidential", "TLP:AMBER", anythingcover_footer_text Custom legal / disclaimer linecontact_email Where the client repliespage_footer_attribution Bottom-of-page bylinepdf_title_template Filename pattern with placeholderspdf_author PDF metadata author fieldfirm_name: "Acme Pentest Co." logo_path: "branding/acme/logo.svg" primary_color: "#b45aff" accent_color: "#ff6b9d" cover_classification: "Restricted" cover_footer_text: "Acme & client only." contact_email: "[email protected]" pdf_author: "Acme Pentest Co."
Capture files from physical engagements never leave your network. Vaultprobe ships as a single Docker image that serves both a browser-based web UI and a CLI — bring it up, open the UI or point your scripts at the API, and generate reports. No cloud dependency.
docker compose up -d and you're live.VAULTPROBE_LOG_FORMAT=json.VAULTPROBE_CLASSIFIER=mock — zero external calls, ~3,800-line template engine ships in the image.vaultprobe scan --format oscal emits RFC 4122-valid Assessment Results JSON for federal-adjacent GRC platforms.# 60-second self-host (FastAPI evidence service) $ # contact [email protected] for evaluation access $ cd vaultprobe $ cp .env.example .env $ $EDITOR .env # set VAULTPROBE_API_KEY, # optional ANTHROPIC_API_KEY $ docker compose up -d # Deep health check — runs validate→parse→classify $ curl localhost:8000/health {"status":"healthy","version":"1.0.0", "checks":{"validate":"ok", "parse":"ok", "classify":"ok"}} # Run the CLI locally — render a branded PDF $ pip install -e . $ vaultprobe scan ./captures \ --client "Acme Ltd" --tester "A. Carter" \ --branding branding/acme.yaml → Vaultprobe_Report_Acme_Ltd.pdf → SHA-256 chain of custody: verified ✓
Every finding the PDF renders is also available as structured JSON via /api/v1/scan — feed it into your GRC platform, your SIEM, or your client's evidence locker. The API speaks the same vocabulary your auditors already understand: ISO control IDs, NIS2 sub-paragraphs, CVE references, SHA-256 hashes.
iso_controls array.nis2_controls, iso_controls, cve_references, academic_citations, and the full chain-of-custody record.--format oscal on the CLI to render Assessment Results JSON for Xacta / RegScale / Telos / eMASS. Each finding becomes one OSCAL observation + finding + (for high/critical) risk with deterministic UUIDs.$ curl -X POST localhost:8000/api/v1/scan \ -H "X-API-Key: $VAULTPROBE_API_KEY" \ -F "[email protected]" { "engagement": { "master_evidence_id": "VP-2026-9a3f...", "tester_name": "A. Carter" }, "findings": [{ "finding_id": "uuid...", "type": "nfc", "card_type": "Mifare Classic 1K", "uid": "04 A2 3B 4C", "encryption_status": "weak", "cloneable": true, "risk_level": "critical", "iso_controls": ["A.7.2","A.7.3","A.8.20"], "nis2_controls": ["21(2)(h)","21(2)(i)"], "cve_references": [], "academic_citations": [ "de Koning Gans 2008" ], "custody_record": { "evidence_id": "VP-2026-...", "sha256": "9a3f..." } }] }
NIS2 makes essential and important entities accountable for proving their cybersecurity risk-management measures work. Vaultprobe maps every physical-pentest finding to the relevant Article 21(2) sub-paragraphs — so the report your pentester delivers is the same report your auditor wants to see.
Findings tagged against your ISMS scope — physical perimeter, access control, removable media — with risk narrative auto-generated.
Captures evidencing detection blind spots (unauthorised physical access, rogue access points) flagged with response gap analysis.
OT / BMS findings against the building-management VLAN feed straight into the BCP risk register — DR comms cabinet, lift cores, HVAC.
Vendor fingerprinting flags HID, Lenel, ASSA ABLOY firmware versions against known CVEs — raw input for your supplier risk register.
Insecure-by-design findings (EM4100 cloning, Mifare Classic) cited against NIST SP 800-116 for the lifecycle conversation.
The report itself is the assessment artefact. Cryptographic chain of custody means it's defensible at audit and in court.
Default-credential, weak-key and obvious-clone findings highlight where security awareness or hardening playbooks need refreshing.
Weak-encryption / no-encryption findings (Mifare Classic CRYPTO1, Telnet, FTP, plaintext SCADA) mapped to encryption-policy gaps.
Tailgating routes, badge-cloning evidence, after-hours physical-access tests — all mapped to your access-control measures.
Single-factor RDP, single-factor RFID-only doors and missing PIN-pad enforcement called out against the MFA obligation.
All ten Article 21(2) sub-paragraphs (a–j) are mapped in the engine. Highlights shown above.
PlexTrac and Dradis are excellent for traditional pentest reporting — but they were built for Nessus/Burp output, not Flipper Zero captures. Manual reporting still wins on flexibility but loses two days per engagement. Here's how Vaultprobe compares on the things that matter for physical work.
| Capability | Vaultprobe | PlexTrac | Dradis | Manual (Word) |
|---|---|---|---|---|
| Native Flipper / Proxmark / Chameleon parsers | ✓ 10 hardware formats | ✗ Manual paste | ✗ Manual paste | ✗ Hours per finding |
| Hak5 suite (Pineapple, Shark Jack, Bunny, Turtle, Croc, Squirrel) | ✓ 6 native parsers | ✗ | ✗ | ✗ |
| SHA-256 cryptographic chain of custody | ✓ Per-artefact | ~ Asset-level only | ✗ | ✗ |
| ISO 27001:2022 + NIS2 dual mapping | ✓ Auto-mapped | ~ Manual tagging | ~ Manual tagging | ~ If you remember |
| IEC 62443-3-3 mapping (physical & serial/OT findings) | ✓ Auto-mapped | ✗ | ✗ | ✗ |
| Vendor fingerprinting (HID, Lenel, ASSA ABLOY) | ✓ 31 vendor entries | ✗ | ✗ | ✗ |
| AI-generated narrative (with rule-based fallback) | ✓ Anthropic or mock | ~ Add-on | ✗ | ✗ |
| Self-host via Docker (air-gappable) | ✓ One image | ~ Enterprise SKU | ✓ | ✓ N/A |
| White-label per-firm branding via YAML | ✓ One file | ✓ Templates | ~ CSS edit | ✓ Word skin |
| Open SBOM (CycloneDX) | ✓ Per release | ✗ | ✗ | ✗ |
| NIST OSCAL Assessment Results output | ✓ Native --format oscal |
✗ | ✗ | ✗ |
| Cloud pentest support (AWS / Azure / GCP) | ✓ ScoutSuite + Pacu + PMapper | ~ Manual paste | ~ Manual paste | ✗ |
| Time per finding (capture → report) | ~30 sec | ~10 min | ~15 min | ~45 min |
Vaultprobe runs entirely on your own infrastructure — client capture data never leaves your network. It is also the only reporting tool that turns physical and RF capture (Flipper, Proxmark, RFID, Sub-GHz, Wi-Fi Pineapple) into evidence reports; PlexTrac, Dradis and AttackForge are cloud-based and built for network and web findings, and none of them read hardware capture. Licences are per firm, billed annually — there is no per-seat counting on software you host yourself.
The full product, self-hosted with your own branding. Generate a usable report in week one or get your money back. The £500 credits toward your first annual licence if you convert within 30 days.
Everything, licensed to one firm. Unlimited reports, unlimited internal users, one annual licence. Sized for boutique teams of up to around ten staff.
Everything in Boutique, for larger practices, from £15,000 a year. The final figure depends on team size and the parser work you need.
Every tier is self-hosted. Your client capture data never leaves your network, and licences are per firm with no per-seat metering. SSO, SOC 2 and Cyber Essentials Plus are planned for 2026–2027, not yet attained.
Stop generating Word documents. Generate compliance evidence. Your findings feed directly into your clients' GRC platforms. That's a service upgrade, not just a time saving.
Structured evidence for every engagement. Defensible in front of any CISO. Chain of custody that holds up under technical scrutiny and legal review.
Look like a senior analyst. Every time. Vaultprobe produces reports your clients will reference in board-level security discussions.
NIS2 and ISO 27001 demand objective evidence that physical perimeters work — and IEC 62443-3-3 does the same for industrial and embedded environments. Vaultprobe produces machine-readable evidence packages with cryptographic chain of custody your auditors can review and validate. No more relying on a Word document.
VAULTPROBE_CLASSIFIER=mock to lock it down.
vaultprobe verify command re-hashes any file and confirms it matches the report. Tamper-evident, court-defensible, and your auditor can validate it without our help.
The £500 pilot is a 30-day evaluation you run on your own infrastructure. Share a few details and we'll send your invoice, Docker image access, and licence token to get you started.
Prefer to talk it through first? Book a 30-min demo →
Vaultprobe is available now as a self-hosted pilot. If you're not ready to buy, grab the free sample report and join our list for occasional product updates. No pitch. No spam.
Occasional emails. Unsubscribe anytime.
Practical, vendor-neutral writing on the evidence problems behind every physical engagement. No pitch, just the working detail.
What an unbroken custody chain requires, and how device-side SHA-256 hashing at the point of capture makes a finding tamper-evident.
Read the guide → Capture integrityHow a capture is shown unchanged from collection to report: raw-byte hashing, downstream re-verification, and clear tamper status.
Read the guide → Defensible reportingTraceable evidence, ISO 27001, NIS2 and IEC 62443 mapping, and findings a client's auditor can reproduce.
Read the guide →