How can we help you?

No. Support is included on every plan. Reach the team from your dashboard, by email, or through the contact options above, and enterprise engagements include a named contact.

Head to the trust center and request access, or email security@penops.com. We'll share the report under NDA, usually within one business day.

Open the engagement in your dashboard and use 'Report an issue' on the finding. That attaches the run context automatically so we can reproduce it quickly.

Yes. Agents pause for human sign-off before any consequential action, and guardrails define what they will never do unasked: no data exfiltration or lateral movement without approval.

Security is foundational to PENOPS. Connecting your environment never gives PENOPS or its employees standing access to your systems. Every action follows zero-trust principles, is authorized only when needed, and is fully auditable.

• Zero-trust, no standing access: Every action is brokered through just-in-time, least-privilege access, granted only for the specific task being performed. Neither humans nor services, yours or ours, hold persistent or privileged access to your environment.
• Protected credentials: Your credentials stay under your control and are used only when explicitly authorized, through secure, short-lived access.
• Isolated, encrypted, tenant-scoped data: Every customer environment is logically isolated and encrypted in transit and at rest. Tenant data can only be decrypted through a tenant-specific identity with explicit authorization, so no shared database account or privileged user can read customer data directly.
• Hardened automation: System accounts are isolated, tightly restricted, and cannot be used by PENOPS employees.
• Ephemeral execution: Pentests run in short-lived, encrypted runners that are automatically destroyed on completion.
• Complete audit trail: Every action the platform performs is logged, timestamped, and fully auditable.
• Enterprise identity for everyone: Customer identity and access runs on enterprise-grade identity management, with role-based permissions and strong authentication enforced for every account.

This architecture lets PENOPS continuously discover, validate, and verify real-world attack paths without exposing your environment or requiring permanent privileged access.

Only your organisation. Everything PENOPS discovers, from your asset inventory to validated findings, is visible exclusively to the people you authorize in your tenant. Your security posture is never shared, compared, or exposed to anyone else.

• Your eyes only: Findings, attack paths, and reports exist solely inside your tenant. No other customer, partner, or third party can ever see them, and PENOPS never publishes or benchmarks customer results.
• You control access internally: Role-based permissions let you decide who in your organisation sees what, so sensitive findings can be restricted to the teams that need them.
• No standing access for PENOPS staff: Our personnel cannot browse your findings. Access is granted only when you explicitly request support, is time-limited, and is fully audited.
• Never used beyond your engagement: Your findings are not used to train models, build marketing material, or inform other customers' engagements.

The point of PENOPS is to show you your weaknesses before an attacker finds them. That only works if the results stay yours, and they do.

Critical issues are triaged within the hour during business hours, and enterprise plans include 24/7 coverage with per-severity SLAs.

Findings can be pushed to your delivery team's board with severity, SLA, and remediation context. Ask us about integrations during onboarding.