Dradis vs Cyver Core

Your clients tell you two things: where the findings may live, and often what the report looks like.

Cyver Core's answer to the first depends on the plan (e.g. Team plan is cloud-only). With Dradis the answer is: your servers, never ours (even during the trial). As for the second, we build your template from the document you today, with Cyver you need to migrate to their report builder.

Cyver Core is the pentest management platform from Cyver, a company based in Amsterdam and founded in 2020. Every Cyver fact below comes from Cyver's own pages, which we read in October 2026, so you can check it without trusting us.

Key Takeaways

  • Where findings live. On Cyver's plan table, the Team plan (up to 5 pentester users) lists cloud deployment only. On-prem comes with annual Professional and Enterprise plans, and air-gapped on-prem is an "Enterprise add-on". Every Dradis plan runs on your servers, can be air-gapped. This includes the trial.
  • Who builds the template. Cyver Core builds reports in its own in-app Template Builder, with Word as an export, and its team can help you recreate your template on request. With Dradis, you send us your current report, we build the template from it, and we keep it up to date at no extra cost.
  • Past five testers, or off the cloud. A sixth tester, or a client who wants findings off a vendor's cloud, moves a Cyver customer from Team (249 EUR a month, annual) to Professional (549 EUR a month, annual), a flat fee with unlimited pentester users. Dradis is priced per seat and billed yearly: Assess is 90 EUR ($100) per seat per month.
  • Scanner output. Both import the common scanners. In Dradis, the Rules Engine swaps incoming scanner text for your team's approved write-ups from the Issue Library and de-duplicates findings from several scanners.
  • Source code and extensibility. Cyver Core's closed source. Dradis Pro is built on the open-source Community Edition, so your team can read the code and write its own importers and plugins.

This comparison is for you if

Read this if:

  • You run delivery at a consultancy of 5 to 20 testers, and Cyver Core is on your shortlist.
  • Your clients are banks, government bodies or defense suppliers that set the report format and have rules about where findings may live.

Skip this if:

  • You want the vendor to run, patch and back up the tool for you. There's no hosted Dradis, on any plan.

Side-by-side summary

  Cyver Core Dradis Pro
Deployment model SaaS-first (vendor-hosted Azure); On-prem on Professional and Enterprise annual plans only Self-hosted-first (on-prem, AWS,Azure,GCP, air-gapped)
License Proprietary. Cyver's terms grant a limited license to use it and bar copying, modifying or derivative works Open-source core (GPLv2): inspect, audit, fork, run perpetually
Air-gapped Enterprise add-on, no price in the plan table Yes. Works offline, activation included
Report output PDF and Word on every plan; HTML on Enterprise Word (.docx), Excel (.xlsx), CSV, HTML, PDF
Report templates In-app Template Builder; 10 templates on Team, unlimited on Professional; Unlimitted. We build your template from your current report and keep it up to date
Findings library Finding libraries with CVE, CWE and Exploit-DB references; review workflows Issue Library and Quality Assurance with revision history
Scanner imports 23 file imports listed 47+ tool integrations; Rules Engine for automation rules, Mapping Manager for multi-template support
Client delivery White-labeled Client portal from Professional and up; ticketing connector on Enterprise Results Portal on every paid plan; Jira, Azure DevOps, ServiceNow on Remediate
AI drafting Azure OpenAI integration Echo: with self-hosted Ollama or frontier labs (Anthropic, Gemini or OpenAI)
Price (list) Team 249 EUR, Professional 549 EUR a month on annual plans; monthly billing offered; Enterprise on quote Assess 90 EUR ($100), Remediate 180 EUR ($200) per seat per month, billed yearly; 3-seat minimum
Trial 15 days 14 days, on your own servers

Cyver Core facts from its pricing page, plan table and the pages linked below, as of October 2026. Dradis facts from our pricing page.

Where your clients' findings can live

Cyver lists three hosting models on its hosting page:

  1. A fully managed cloud (Microsof Azure)
  2. A dedicated private deployment
  3. An on-prem Docker deployment inside your own infrastructure, which you run

Which model you can buy depends on the plan:

  • Team lists "Cloud Deployment" only.
  • Professional adds on-prem Docker, on annual plans only. A private deployment is an add-on.
  • Enterprise adds air-gapped on-prem Docker as an add-on.

At Dradis, we never see your clients' findings: there is no hosted Dradis. It runs on your own hardware, your own AWS, Azure or GCP account, or air-gapped, and every feature works offline by design. The trial runs there too, so from the first finding your team types into Dradis, everything stays on your server.

AI drafting sends finding text to a model, on someone's server. Cyver's generative AI page lists an "Azure OpenAI integration" and claims no customer data is used for model training. Echo with Ollama runs the model on your own server, with no external API, air-gapped included. You can also configure other AI providers.

Cyver's homepage says "SOC2 Certified", and its post on the audit says it finished "in January 2023". That report answers a question you only have when a vendor keeps your findings: who on the vendor's side can read them? However, there is a lot a vendor's SOC 2 report leaves out. With Dradis the question doesn't come up, because we never receive your findings: nobody but you has access.

Who builds each client's report template

Cyver Core builds reports in a Template Builder inside the app. From an April 2021 article: "While many pentest management and report automation platforms use DocX templates, Cyver Core uses a customizable and modular Template Builder inside our platform." Its current support article still describes sections, tokens and CSS styling, with Word as a file exported from that template. It also says "the Cyver Core team can help you recreate your existing report template inside the Cyver Core platform," through your customer success manager. The article doesn't say what that help costs or which plans get it. The Team plan caps report templates to 10; Professional has no limit.

With Dradis, send us the report you deliver today, and we send back the Dradis template that reproduces it. The template is a Word document built from yours, so the styles, headers and tables come through as they are. If one of your clients has its own macros or bookmarks on their report format, those still work, because every report starts from the client's own document. The conversion and every update after it come with every paid plan, at no extra cost. Each client can have their own template variant, so the bank gets its format and the defense supplier gets theirs, from the same project data. Our concierge reporting service has built and maintained over 1,182 templates since 2010, for teams in 81 countries.

This is what Dradis customers have to say about our reporting engine:

"We can now easily create a number of different reports out of the same data using different templates."

Tone Gorup, Unistar Pro

"We can always count on the Dradis team for report format changes."

Andrew Cho, Senior Principal, Cybersec Risk Engineer, Schneider Electric

What changes between 5 and 20 testers

Cyver Core's Team plan is limited to five pentester users. The sixth moves you to Professional at 549 EUR a month on an annual plan, with unlimited pentester users and templates. Ticketing integrations, SAML2 single sign-on and Gantt scheduling are listed under Enterprise.

Dradis is priced per seat, with a three-seat minimum and no cap. Assess is 90 EUR ($100) per seat per month, billed yearly. Ticketing integrations are in the Remediate plan. Single sign-on and the audit log come with Enterprise.

Team is cheaper at five testers, but it's cloud-only and caps you at 10 report templates. Dradis has no template limit. If data sovereignty is a concern, Cyver's first option is a Professional plan, billed annually, which Dradis Assess undercuts for small teams. Every Dradis seat includes air-gapped deployment (vs it being an "Enterprise add-on" at Cyver), local AI drafting, and the conversion and upkeep of your report templates.

As the team grows, you need every tester's findings to read the same. Both tools keep a library of reusable write-ups with a review step. In Dradis, the Rules Engine also replaces incoming scanner text with the matching Issue Library entry and de-duplicates findings that several scanners report. The Quality Assurance states let you leave anything unpublished out of the export.

"I'd say we probably save at least a day, maybe two days worth of effort on reporting per project."

Lewis Warner, Technical Lead, Unipart Cyber Security

Delivering to the client

The client portal is central to Cyver Core. It comes with every plan, but fully white-labeled is gated from Professional. It covers findings, remediation SLAs, retesting workflows and dashboards. Its ticketing connector for Jira, Azure DevOps and ServiceNow is listed under Enterprise only.

With Dradis, the deliverable is the report in your client's format, and that's where we put our effort. When a client wants more, Results Portal provides Business Intelligence analytics and Gateway module provides a live, white-labeled view of findings as the assessment progresses, on all plans. While Remediation Tracker provides the in-app ticketing option for those in the Remediate plan (which also has DevOps, Jira, and ServiceNow integrations).

Next step

Try Dradis for 14 days on your own servers, for teams of three or more testers. The trial comes with sample templates for infrastructure, web app and red team assessments. When you subscribe, we convert your own template, and the 30-day money-back guarantee runs from the day the template is ready.

Frequently asked questions

Can Cyver Core be self-hosted?

Yes, by plan. Cyver's plan table lists on-prem Docker on annual Professional and Enterprise plans, and air-gapped on-prem as an Enterprise add-on. On Team, cloud is the only deployment listed. Dradis has no hosted version: it runs only on servers you control, on every plan.

Does Dradis have a client portal?

Yes. Gateway gives your clients a live, white-labeled view of findings as the assessment progresses, with per-customer or per-project themes. It comes with Assess, Remediate and Enterprise. The Community Edition doesn't include it.

When does the Dradis money-back guarantee start?

The 30-day money-back guarantee runs from the day your template is ready, not from the day you pay.

Your clients set the format and where findings live. See Dradis on your own servers. Start the 14-day trial.

About the Author

Rachael Carder. Since 2015 Rachael has been guiding cybersecurity teams to do more with less and reduce their overhead.