• PlexTrac Acquisition: What Pentest Teams Should Do Now
  • This guide applies if
  • The PlexTrac acquisition: what was announced
  • Timeline: Since the announcement
  • What acquisitions typically change, and on what timeline
  • Exposure management and pentest delivery serve different buyers
  • Ten questions to ask your PlexTrac/Brinqa account team
  • Do this week: archive a complete export
  • Get it in writing: five guarantees worth having before renewal
  • If you decide to evaluate other options
  • The question you should also ask us: what if Dradis gets acquired?
  • Practical next steps
  • Related content
  • Frequently asked questions

PlexTrac Acquisition: What Pentest Teams Should Do Now

On August 19, 2026, Brinqa announced it had acquired PlexTrac. If PlexTrac is your reporting platform, you do not need hot takes. You need to know whether anything changes for your team, and what to get in writing before your next renewal. Full disclosure up front: we build Dradis, a competitor. Every claim below links to a source you can check without trusting us.

This guide gives you a 10-question checklist for your PlexTrac/Brinqa account team, a list of what to export this week, and the guarantees worth having before you sign anything.

This guide applies if

Read this if:

• PlexTrac is your pentest reporting platform and you have a renewal coming in the next two quarters
• Your vendor risk management process requires a supplier re-assessment after any acquisition event
• You run a consultancy where PlexTrac is part of your delivery pipeline and you need to evaluate continuity risk

Skip this if:

• You do not use PlexTrac
• Your PlexTrac contract is locked for 12+ months and your procurement process cannot act until renewal regardless (though the export advice in the do this week section still applies)

The PlexTrac acquisition: what was announced

On August 19, 2026, Brinqa announced it had acquired PlexTrac for undisclosed terms. The key facts from the announcement and same-day coverage:

• The combined entity claims 3,000+ customers across 57 countries, including more than 25% of the Fortune 500
• PlexTrac founder Dan DeCloss joins Brinqa's executive leadership team and board, leading the combined offensive-security practice (source)
• Both companies are Insight Partners portfolio companies: Insight led Brinqa's $110M growth investment in June 2021 and PlexTrac's $70M Series B in February 2022
• Brinqa's stated strategy: add offensive-security validation, pentest workflow, and remediation verification to Brinqa's "unified exposure management" platform, "closing the CTEM loop"
• Brinqa's message to PlexTrac customers: "pentest teams and workflows now plug directly into a CTEM program instead of sitting next to one"

Our stake: We build Dradis, a self-hosted, open-source pentest reporting platform that competes with PlexTrac. We are not neutral observers. Weigh the guidance below accordingly, and check every source link.

Timeline: Since the announcement

A dated record of material developments after August 19, 2026, newest first. We add an entry when something is worth bringing to one of the ten questions below.

September 30, 2026 – "newly acquired PlexTrac functionality." Brinqa's announcement of a rebuilt data engine and an AI Exploitability Agent includes this: "Newly acquired PlexTrac functionality gives teams a way to confirm assessments." Question 2 is PlexTrac still a standalone product, or "functionality" of Brinqa's platform?

September 23, 2026 – "the joint solution." Demoing PlexTrac on CIO.com's DEMO show (a vendor show-and-tell format), PlexTrac's founder calls penetration testing "our core foundation" and describes the post-acquisition offering as "the joint solution that really brings all of this to the market." Question 2 asks whether PlexTrac remains a standalone product, and on what timeline.

September 14, 2026 – the founder makes the case for the combined offering. In an interview with Pulse 2.0, PlexTrac's founder describes the combined offering as "a single source of truth of what was found, tested, prioritized, fixed, and verified." Questions 1 and 2 ask what stays committed for the pentest management and reporting product.

What acquisitions typically change, and on what timeline

Vendor acquisitions in security tooling follow recognizable patterns. None are certain in any specific deal, but they shape what questions to ask and when.

Roadmap re-prioritization happens within 6 to 12 months. The acquirer bought the company for a reason, and that reason shapes where engineering resources go. Features that serve the acquirer's core buyer get investment. Features that served a different buyer base get maintained, deprioritized, or retired.

Contract and pricing changes appear at renewal, not mid-term. Most acquisition agreements honor existing contracts. The question is what happens when yours comes up.

Support team consolidation is common within the first year. Your account manager may change. Support channels may merge. Response times and escalation paths may shift.

Product line rationalization plays out over 12 to 24 months. The acquired product may become a module, a feature set within a larger platform, or a product no longer sold standalone.

Data-handling terms can change as infrastructure consolidates. Where your data is stored, who has access, and under what terms may look different under the acquirer's operational model.

These are patterns from vendor management practice, not predictions about this deal. The supply-chain risk principle from NIST SP 800-161 applies:

Favor architectural controls (what you can verify yourself) over vendor assurances (what you are told will remain true).

Exposure management and pentest delivery serve different buyers

PlexTrac was built for pentest teams: consultancies running client engagements and internal offensive teams delivering assessment reports. It grew into one of the category's default mindshare holders on that value proposition.

Brinqa's business is enterprise vulnerability and exposure management. Its buyers are CISOs running CTEM programs, not consultancies delivering client reports. An acquisition folds the acquired product's roadmap into the acquirer's thesis. Brinqa says so in the announcement: pentest teams "plug directly into a CTEM program."

Whether that is good or bad depends on which side of this fork you sit on:

• Enterprise internal team running a CTEM program: you may benefit. A pentest workflow that feeds into your exposure management platform could reduce the gap between finding and fixing.
• Consultancy using PlexTrac as your delivery backbone: ask where client-services workflows (custom reporting, client-facing deliverables, per-engagement project structures) rank in a roadmap now oriented toward enterprise exposure management buyers.

The 10 questions below are designed to help you find out.

Ten questions to ask your PlexTrac/Brinqa account team

Send these before your next renewal conversation. Each includes a note on what a good answer looks like.

1. What are the written roadmap commitments for the pentest-reporting product line over the next 24 months?

A good answer names specific features and timelines, not "we remain committed to pentest teams." Ask for a document you can reference at your next renewal.

2. Will PlexTrac remain a standalone product, or will it become a module within the Brinqa platform?

A good answer is specific about timeline and packaging. "Standalone for now" is weaker than "standalone through at least [date], with the following integration points planned."

3. What are the renewal pricing and term guarantees, in writing?

A good answer is a written commitment to pricing terms for a defined period. Verbal assurances do not survive personnel changes.

4. Will the support team remain the same? Same people, same SLAs, same escalation paths?

A good answer names who will handle your account and confirms SLA terms in writing. Support continuity is one of the first things that shifts after an acquisition.

5. What are the data export options, and will they remain available at current terms?

A good answer details export formats (findings, evidence, templates, user data, project history), confirms completeness, and commits to availability for your contract's duration. Pay attention to whether WriteupsDB content is included and in what format.

6. Will the data-handling terms change as infrastructure consolidates?

A good answer tells you where your data will be stored, who has access, and whether your current contract terms carry forward. If your data lives on PlexTrac's infrastructure, ask what happens when that infrastructure merges with Brinqa's.

7. What happens to WriteupsDB content ownership and portability?

A good answer confirms that the content your team created (reusable findings, templates, vulnerability descriptions) remains yours and exportable in a usable format. If portability is limited, you want to know before renewal, not after.

8. What is the integration and API deprecation policy?

A good answer provides a minimum notice period for any API or integration changes. If your workflow depends on PlexTrac's API (Jira tickets, CI/CD hooks, custom integrations), you need to know how much runway you get before breaking changes.

9. If product lines merge, what is the sunset policy for current PlexTrac features?

A good answer defines what "sunset" means in practice: how much notice, whether data migration assistance is included, and what happens to functionality your team depends on.

10. Who owns the customer relationship after integration is complete?

A good answer tells you whether your primary contact stays, who to escalate to, and whether your account sits in the pentest division or the broader Brinqa organization.

Do this week: archive a complete export

Whether you plan to stay or start evaluating other options next quarter, run a full data export this week and store it on infrastructure your team controls.

This is standard vendor-risk hygiene after any acquisition event. It costs nothing, takes an afternoon, and gives you a baseline you can reference later.

What to export:

• All project data: findings, evidence, notes, attachments
• WriteupsDB entries (your reusable finding descriptions)
• Report templates
• Runbooks and methodology templates
• User and team configuration (roles, permissions)
• Custom integrations or API configurations (document these separately, even if not exportable as files)

Check PlexTrac's current export documentation for available formats and completeness. If anything is unclear, fold it into checklist question 5 above.

Store the export on infrastructure your team controls, not on the platform you are de-risking.

Get it in writing: five guarantees worth having before renewal

If you decide to renew, get these five commitments in writing as contract terms, not verbal promises:

1. Pricing lock for a defined term (at minimum, the length of the renewal contract)
2. Product roadmap commitments: which pentest-workflow features stay, which are being re-evaluated, and on what timeline
3. Data export availability at current terms and in current formats for the contract's duration
4. SLA and support channel continuity: named support contacts, defined response times, escalation paths
5. Change-of-control survivability: confirm the commitments above bind successor entities. Growth investors realize returns through liquidity events, so plan for the possibility of further ownership changes within your contract's term.

A vendor that cannot commit to these in writing after an acquisition is telling you something useful.

If you want to understand your team's exposure to vendor platform risk more broadly, score your own vendor risk profile. It takes about two minutes and covers the questions that apply regardless of which platform you use.

---

Your reporting workflow, findings data, and delivery pipeline all depend on a single vendor's corporate decisions. This acquisition is a good moment to ask whether that dependency is one you want to carry into your next contract. Operational Continuity and Data Sovereignty are two of our Platform Guarantees.

---

If you decide to evaluate other options

Switching pentest reporting platforms mid-contract is not realistic for most teams. The practical window is at renewal, which is why the checklist and guarantees above matter now.

If you do start an evaluation, the switching cost is real. Plan for template migration, finding library reconstruction, integration reconfiguration, and team retraining. For a team of five to ten people, budget two to four weeks of part-time effort depending on how much customization you have built into PlexTrac. If you're considering Dradis, our concierge team will handle the transition for you.

For a head-to-head comparison of PlexTrac and a self-hosted option: Dradis vs PlexTrac. For the broader reporting tool landscape: Pentest Report Generator Comparison.

The question you should also ask us: what if Dradis gets acquired?

Here is the structural answer, which you can verify yourself.

Dradis is self-hosted and built on an open-source core licensed under GPLv2. If Security Roots were acquired tomorrow:

• Your Dradis instance, running on your own infrastructure, keeps running. There is no cloud service to discontinue. Your server, your data, your uptime.
• The GPLv2 license is irrevocable. The codebase as it exists today is permanently available to run, fork, and modify. No acquirer can change the license on code already released under GPLv2.
• Your findings, templates, Issue Library, and project history are files on your server. No vendor event creates a data-hostage problem because there is no vendor-controlled infrastructure holding your data.

This is not a contractual promise that can be renegotiated at renewal. It is an architectural property of how the platform is built. A cloud-hosted platform cannot make this claim, because the data lives on vendor infrastructure, and a vendor acquisition changes who controls that infrastructure.

Dradis has been self-hosted and open-source since 2007, with 19 years of continuous development. 1,182 security teams across 81 countries use it today. Security Roots is bootstrapped, with no outside investors and no exit timeline.

For more on how self-hosted platforms handle the operational continuity question: Operational Continuity in Penetration Testing. For the data sovereignty angle: Why Your Reporting Platform Is a Security Decision.

Practical next steps

1. This week: run a full data export from PlexTrac and store it on infrastructure your team controls.
2. Before your renewal conversation: send the 10-question checklist to your PlexTrac/Brinqa account manager.
3. At renewal: get pricing, roadmap, data export, support, and change-of-control guarantees in writing as contract terms.
4. If evaluating the self-hosted model: score your vendor risk exposure to see where your dependencies sit, or see what a self-hosted migration looks like.

Related content

Context:

• Operational Continuity in Penetration Testing: what happens when your reporting platform has a bad day, and the architectural decisions that determine your exposure
• Pentest Data Sovereignty: why your reporting platform is a security decision, not a workflow one
• Why do teams choose Dradis?

Evaluation:

• Dradis vs PlexTrac: a head-to-head comparison covering data sovereignty, deployment, and reporting workflow differences
• Migrate from PlexTrac to Dradis: how your WriteupsDB write-ups move into the Issue Library, how we rebuild your templates, and what to do with old projects
• Cloud vs Self-Hosted Pentest Reporting: a side-by-side comparison of what you control and what you delegate under each deployment model
• Pentest Report Generator Comparison: the broader reporting tool landscape, including open-source and commercial options

Product:

• Data Sovereignty by Design: how Dradis handles the data residency question by keeping everything on your infrastructure

Frequently asked questions

---

Your team's delivery workflow should not depend on which company owns the platform next quarter. If you want to see what pentest reporting looks like on infrastructure you control, built on a codebase you can inspect: book a walkthrough.