PostVAPT
PostVAPT reads the reports from vulnerability scanners and penetration tests, says what to fix first and why, checks that fixes really worked, and produces compliance evidence for PCI DSS v4.0 and the Bangladesh Bank ICT Security Guideline v4.0. It runs on your own server, so scan data never leaves the network.
The problem
A scan can return hundreds of findings all marked critical, so teams do not know where to start, and after a fix nobody checks that it actually worked. Audit evidence is then put together by hand. PostVAPT turns that mess into a short, ordered list of work with deadlines and reasons.
What it does
- Turns hundreds of findings into a short, ordered list, each with a deadline and a clear reason.
- Uses real-world threat data: the CISA list of vulnerabilities being exploited now (KEV) and the EPSS attack-probability score.
- Takes business context into account, so findings on internet-facing and critical systems rise to the top.
- Tracks new, persisting, fixed and reappeared findings across scans, with deadlines that never reset.
- Confirms a fix with a safe retest before it is closed.
- Produces a one-click evidence pack mapped to PCI DSS v4.0 and Bangladesh Bank controls, with clause and page.
- Keeps people in control: lowering a scanner's severity needs an analyst's approval, and every action is recorded.
Works with your scanners
Reads output from Nessus / Tenable, OpenVAS / Greenbone, Burp Suite, OWASP ZAP, Nmap, Nuclei, SARIF tools (Trivy, Grype, Semgrep, CodeQL) and CSV exports from Qualys, Rapid7, Acunetix and Invicti. The format is detected automatically.
Private by design
Runs on-premise and works offline. Scan data is stored in a local database and is never sent to the developer. The internet is used only for optional features you control, such as live CVE threat data.