What does Pencheff scan?

Pencheff covers web applications (DAST), APIs, source code (SAST), dependencies (SCA), software bill of materials (SBOM), infrastructure-as-code, AI and LLM systems, network, and mobile — all from a single assessment queue with unified findings.

How long does a Pencheff assessment take?

Quick profile: 2–5 minutes. Standard: 10–25 minutes. Deep: 30–90 minutes, depending on application breadth and the number of endpoints discovered.

Are Pencheff reports accepted by SOC 2, PCI, or ISO auditors?

Yes. Reports map findings to OWASP Top 10 (2021), PCI-DSS 4.0, NIST 800-53, SOC 2 CC6/CC7, ISO 27001:2022, and HIPAA Security Rule — formatted for direct use as evidentiary material in compliance audits.

Is Pencheff free to use?

Pencheff is free during open beta with no feature gating and no card required. Every shipped capability is unlocked at $0 while the platform is in beta.

Supply chain · Platform

Platform overview

Run web, API, code, dependency, cloud, AI, and internal-network assessments from one queue with unified findings, evidence, remediation, and audit output.

SCA and SBOM workflows connect vulnerable components, manifests, package URLs, fixed versions, reachability, EPSS, KEV, SSVC, and license evidence to the same findings and reports as application testing.

Start free Sign in

Surface routerunified

8coverage areas

5operator steps

4evidence fields

Coverage8

Execution5

Evidence4

Controls4

URLRepoAPIAICloud

One queue routes every target kind into a single normalized findings and evidence model.

ScopeWhat Pencheff does

SectionPlatform

MethodDeterministic-first

OutputUnified evidence

ProfileSupply chain

Coverage

What does Platform overview test?

A complete adversarial security platform
Run web, API, code, dependency, cloud, AI, and internal-network assessments from one queue with unified findings, evidence, remediation, and audit output.
Dropdown section: What Pencheff does.
OSV.dev, NVD 2.0, GitHub Advisory Database, RustSec, GoVulnDB, EPSS, CISA KEV, and SSVC enrichment.
Manifest support for npm, PyPI, Go modules, Cargo, Ruby, Composer, Maven, OS packages, and container packages.
SPDX 2.3 and CycloneDX 1.5 SBOM generation with optional Syft enrichment.
Reachability annotation that separates exploited, reachable, present, and unknown risk.
License policy checks and deterministic version-bump remediation for eligible dependencies.

Execution

How does Pencheff run this?

Parse repository manifests, lockfiles, or container package inventories.
Resolve packages to advisories, fixed versions, package URLs, and known exploitation signals.
Annotate reachability from imports, call paths, runtime evidence, or scanner context.
Generate SBOM output and link component rows back to findings.
Prioritize remediation by exploitability, reachability, business criticality, and compliance impact.

Evidence

What evidence does this produce?

Package name, ecosystem, installed version, fixed version, advisory id, CVSS, EPSS, KEV, and SSVC.
SBOM component records with PURL, supplier, version, license, and dependency relationships.
Reachability state, import evidence, or reason the vulnerable component is currently only present.
Audit appendix output for procurement, compliance, and release records.

Controls

How is this kept safe to run?

Dependency risk is not sorted by CVSS alone; operational signals influence priority.
SBOM generation is repeatable and latest-generation output replaces stale records.
License and vulnerability policy can be used as release-gate input.
Version-bump fixes are deterministic when advisory metadata supports them.

↗

Documentation

Read the full reference.

FAQ

Common questions

What does Pencheff scan?: Pencheff covers web applications (DAST), APIs, source code (SAST), dependencies (SCA), software bill of materials (SBOM), infrastructure-as-code, AI and LLM systems, network, and mobile — all from a single assessment queue with unified findings.
How long does a Pencheff assessment take?: Quick profile: 2–5 minutes. Standard: 10–25 minutes. Deep: 30–90 minutes, depending on application breadth and the number of endpoints discovered.
Are Pencheff reports accepted by SOC 2, PCI, or ISO auditors?: Yes. Reports map findings to OWASP Top 10 (2021), PCI-DSS 4.0, NIST 800-53, SOC 2 CC6/CC7, ISO 27001:2022, and HIPAA Security Rule — formatted for direct use as evidentiary material in compliance audits.
Is Pencheff free to use?: Pencheff is free during open beta with no feature gating and no card required. Every shipped capability is unlocked at $0 while the platform is in beta.