PDF reports · pen tests, past vendors, assessments
Turn a pen test report PDF into a remediation plan you can track
Penetration testers, past vendors and assessors hand over PDFs, not scanner exports. Upload the PDF to Varaxon Scan Hub: Anthropic AI models list the findings on each page, you check every one against its page, and only the findings you confirm go into a ranked, evidence-led report and the client's history.
What Scan Hub reads from PDF reports
Every finding, with its page.
Each finding's title, the system it affects, the severity as the document writes it, any CVEs it names and the port, each shown beside the page number it came from.
You confirm. The AI doesn't decide.
Findings come back as a draft. Rows worth a second look are flagged, for example a severity that isn't beside the finding, or that differs on another page or from the document's own totals. Leave out anything wrong.
Ranked like any scan.
Confirmed findings go through the same ranking as scanner exports: CVEs are checked against CISA's Known Exploited Vulnerabilities catalog, EPSS and CVSS, and fixes are grouped into the fewest actions.
How to bring a PDF report in
- On New report in Scan Hub, choose the client and drop in the PDF: a penetration test report, a past vendor's vulnerability report or a security assessment.
- Tick the box to agree before anything is read. Host names, addresses and email addresses Scan Hub recognises are replaced with placeholders before the text is sent to Anthropic AI models.
- Reading is free and usually takes under a minute. Check each finding against its page, set a severity where the document gives none, and leave out anything that isn't a finding.
- Confirm, and the report is written from the findings you kept. It uses 1 report, refunded if it can't be written.
What the report states explicitly
- The report says its findings were read from a PDF report, not a scanner export, and that a person checked each one.
- Only findings you confirmed are reported. Nothing the AI read goes into a report until you confirm it.
- Where the document names no CVE for a finding, the report says the CVE set is unknown rather than implying there is none.
- Later scans of the same client show what was fixed since the pen test, so the PDF becomes the starting point of a tracked history, not a file in a folder.
Common questions
- Which PDFs can Scan Hub read?
- Text PDFs up to 20 MB and 60 pages, as saved from a report tool or a scanner. Scanned pages and pictures of pages can't be read, and password-locked PDFs need an unlocked copy. If your scanner offers a CSV, XML or JSON export, that is still the better file.
- Does reading a PDF cost anything?
- Reading is free, up to 20 PDFs a day per organization. Writing the report from the findings you confirm uses 1 report, the same as any upload, and it is refunded if the report can't be written.
- What is sent to the AI, and what happens to the file?
- Only with your agreement, the text of the PDF's pages is sent to Anthropic AI models, with recognised host names, addresses and email addresses replaced by placeholders. Your data is not used to train models. The uploaded file is deleted within 7 days. See the Privacy Policy.
- Can the AI add findings or change severities?
- It lists what each page says, with the page number, and flags rows to look at. You decide what is kept and set any missing severity. The ranking itself is calculated by code from the confirmed findings, not by the AI.
Guide
Penetration test report templateEvery section a pen test report needs, and what to do with its findings once it lands.Read the guide