Dradis vs AttackForge
Your clients may dictate two things: what the report looks like, and where the findings live. AttackForge reserves self-hosting and a vendor-built report template for Enterprise. On every Dradis plan, the findings stay on your servers and we convert your report template for you.
AttackForge is a pentest management platform sold as two product lines: Core (four plans, for 1 to 20 testers) and Enterprise. Every AttackForge fact below comes from its own pricing page or documentation, as of October 2026, so you can check us.
Key Takeaways
- Who has access to the findings. AttackForge's Core plans run in a dedicated tenant that AttackForge hosts, in the Azure region you pick. Self-hosting, air-gapped included, is listed for Enterprise. Dradis runs on your servers on every plan, trial included.
- Who converts the template. Every AttackForge plan lets your team build and upload Word templates with its ReportGen tags. Template professional services are listed for Enterprise only. On every Dradis plan, we port your report template and keep it up to date.
- What it costs. Ten testers cost less on AttackForge Consultancy than on Dradis Assess. Consultancy includes neither self-hosting nor a vendor-built template, though, and Enterprise, the AttackForge line that includes them, has no published price.
This comparison is for you if
Read this if:
- You run delivery at a consultancy of 10 to 20 testers. AttackForge is on your shortlist, or it's up for renewal.
- Your clients are banks, government bodies or defense suppliers that dictate the report format and who can access their findings.
Skip this if:
- You want the vendor to run, patch and back up the tool for you. There's no hosted Dradis.
Side-by-side summary
| AttackForge | Dradis Pro | |
|---|---|---|
| Who runs it | Core: AttackForge, in a dedicated tenant in the Azure region you choose. Enterprise: AttackForge, or you | You, in your rack or your own AWS, Azure or GCP account |
| Air-gapped | Enterprise only | Every plan, offline, activation included |
| Who builds the report template | Your team, in Word, with ReportGen tags. Template professional services are listed for Enterprise | We do, on every plan, updates included |
| Report output | ReportGen builds DOCX reports | Word (.docx), Excel (.xlsx), CSV, HTML, PDF |
| Projects | Pro is unlimited. Team, Consultancy and SME have a monthly allowance of new projects; more as in-app Project Credits | Unlimited |
| Client access | Unlimited client users and white-labeling on every plan | Gateway: a live, white-labeled view of findings, on every paid plan |
| Ticketing | Jira, ServiceNow and Azure DevOps through Flows: an in-app upgrade on Core, included in SME and Enterprise | Jira, Azure DevOps and ServiceNow on Remediate and Enterprise |
| Single sign-on | Enterprise | Enterprise, from 5 seats |
| Price (list) | Pro $50, Team $150, Consultancy $300, SME $800 a month; Enterprise on quote | Assess $100, Remediate $200 per seat per month; 3-seat minimum; yearly billing only |
| Trial | Free and fully featured, in a tenant AttackForge runs | 14 days, for teams of 3 or more, on your own servers |
AttackForge facts from its pricing page and plan table and the documentation linked below, as of October 2026. Dradis facts from our pricing page.
Who can access your clients' findings
AttackForge's plan table lists hosting on Core (Pro, Team, Consultancy and SME) as a "Dedicated Tenant with Choice of Location", and the same page names the data centres: "Azure regions worldwide". That answers a client who wants findings kept in one region. It doesn't answer a client who says the findings stay on your servers, or inside the client's own network with no internet at all. For that, the table lists "Self-Hosted" under Enterprise, and AttackForge's self-hosting guide says its Enterprise Server "installs and operates completely air-gapped on your hosted infrastructure."
On every Dradis plan, nobody at Dradis can access your clients' findings. It runs in your rack, in your own AWS, Azure or GCP account, or air-gapped, and every feature works offline, activation included. The trial runs on your servers too, so the first finding your team types into Dradis is already on your server.
Who builds each client's template
AttackForge builds reports with ReportGen, which works by "combining a DOCX template with an AttackForge project JSON file", in the words of its ReportGen documentation. You write the template in Word, place ReportGen tags where each piece of project data should go, and style each tag the way it should print. AttackForge's reporting guide offers an offline browser tool "to help you build and debug your templates", and you can upload as many as you like. So you can have your own template on any AttackForge plan. What changes by plan is who builds it: "Report Template Professional Services" is ticked for Enterprise and crossed for Core.
Converting your report template is included in every plan. Send us the one you use today, with no client data or findings in it, and we port it to the Dradis format. Updates are included too.
A consultancy rarely has one format. The bank wants its layout, the defense supplier wants another, and each service line has its own. Keep as many templates as you need, one per client or one per service line. A wireless assessment records different fields than a code review, so you pick the template when you start the project, and Dradis checks you've filled in every field it needs. Our concierge reporting service has built and maintained over 1,182 templates since 2010, for teams in 81 countries.
"We can now easily create a number of different reports out of the same data using different templates."
Tone Gorup, Unistar Pro
"We can always count on the Dradis team for report format changes."
Andrew Cho, Senior Principal, Cybersec Risk Engineer, Schneider Electric
What a team of 10 to 20 testers pays
Dradis is priced per seat, with a three-seat minimum, billed yearly. Assess starts at $100 per tester per month, with unlimited projects, self-hosting on your servers and your report template converted for you.
AttackForge prices by plan, not by seat, and it caps your projects. Consultancy allows 10 new projects a month and SME 20, and a busy month means buying Project Credits in the app. The testers are bundled too. Consultancy is $300 a month for up to 10, so you pay for ten testers whether you need them or not, and an eleventh tester moves you to SME at $800.
Yes, Dradis costs more. The two prices don't cover the same things. Consultancy is a tenant AttackForge runs, with templates your team builds in Word. What a busy month costs depends on how many Project Credits you need. If a client requires its findings on your servers, or you'd rather not build templates yourself, you need AttackForge Enterprise, which means asking for a quote. On Dradis, the price is the seat: unlimited projects, nothing to top up.
Next step
The 14-day trial runs on your servers and comes with sample templates for infrastructure, web app and red team assessments. It's for teams of three or more testers. If you like what you see, subscribe on the same install.
We start converting your report template as soon as you send it to us. The 30-day money-back guarantee doesn't start until it's ready.
Related reading
- Dradis vs PlexTrac, another cloud-first platform
- Cloud SaaS vs self-hosted pentest reporting
- Dradis for pentest consultancies
- Pentest report generator roundup
Frequently asked questions
Can we bring our existing report templates and write-ups to Dradis?
Yes. For templates, send us the report template you use today, with no client data or findings in it, and we port it to the Dradis format. For your write-ups, upload a CSV file to the Issue Library. The only required column is Title. If your library won't convert to CSV, send the file to our support team and they import it for you.
Can Dradis run in our own Azure account?
Yes. If your team already works in Azure, install Dradis in your own subscription. Nobody at Dradis can access the findings. It's the same product you'd run in your rack, every feature included.
Can we pay for Dradis monthly?
No. Dradis is billed yearly, in advance, in US dollars, pounds or euros. Assess starts at $100 per tester per month.
Your clients may have their own report format and rules on who can access their findings. Dradis runs on your servers, and we convert your report template. Start the 14-day trial.
About the Author
Rachael Carder. Since 2015 Rachael has been guiding cybersecurity teams to do more with less and reduce their overhead.