1,179+ pixel-perfect report templates converted.

Dradis uses your existing report template. Send us a sample document and we'll recreate your layout, sections, table structures, and visual style as a Dradis template. Your deliverables look identical to what you produce today, generated automatically from project data.

This covers custom section ordering, findings with nested evidence, executive summaries, appendices, and severity-filtered sections. If you have a library of approved vulnerability descriptions, we'll import it into the Issue Library so the same write-ups are reused consistently across every engagement.

Dradis generates Word (.docx), Excel (.xlsx), CSV, HTML, and PDF output. The format is a template decision, not a platform constraint.

Yes. Most reporting tools treat charts as a post-export task: you export findings, build the chart in Excel, paste it into Word, and repeat that for every engagement.

Dradis generates charts directly from project data inside the report template. You design the visual once, severity distributions, CVSS ranges, findings by host, remediation status. When the report generates, Dradis populates those charts automatically from the current project's findings.

No Excel step, no copy-paste, no manual update when a client remediates a finding between drafts. The chart in the document reflects what the data actually says at the time of export.

Pentest findings are detailed blueprints for compromising the assessed infrastructure: which systems are vulnerable, what the attack path looks like, and how far a real attacker could get. When that data lives in a vendor's cloud, you're trusting the vendor's access controls, their breach posture, and their legal jurisdiction.

Self-hosted means Dradis runs on infrastructure you control: your on-premises server, your private cloud account, or an air-gapped network with no internet connection. No finding, screenshot, client name, or AI-assisted write-up is transmitted to Security Roots or any third party.

For assessments of regulated environments, financial, government, or healthcare systems, your engagement data stays within the same compliance boundary as the rest of your work. Learn more about pentest data sovereignty.

Yes. Dradis installs from a local Docker image or a private registry, with no internet connection required after initial setup. Air-gapped deployment is a documented, supported installation path, not a workaround.

Once installed, all core functionality runs entirely on the local host: importing scanner output, building and querying the Issue Library, applying templates, and generating reports.

The AI writing assistant (Echo) requires a local LLM setup via Ollama, which also runs locally and makes no external API calls. Air-gapped environments are common in assessments of critical national infrastructure, defence contractors, and financial institutions with strict network segmentation requirements.

Yes. Dradis uses a three-level data model: Issue (the vulnerability class), Node (the affected system), and Evidence (the specific instance on that node). The template controls how those levels are organized in the output document.

The same project data can produce a finding-centric report, each vulnerability with all affected hosts listed below it, or a host-centric appendix, each host with all findings listed below it. You change the template and re-export. You don't re-enter data or maintain two separate projects.

The same applies across output formats: one project produces a Word report, an Excel remediation tracker with live formulas, a CSV for client data handoffs, and an HTML or PDF version. Data is entered once. How it's structured in the deliverable is a template decision.