What is the difference between CORE and PRO?

CORE is our Apache 2.0 open-source engine. PRO adds the Auto-Assign Rules Engine, Executive Reporting, and Exception Pipelines.

🐴 RiskRancher

Pricing Home

Findings to report. Report to findings.

Auditor is built for pentesters and boutiques who hate turning Word reports into tickets — and turning tickets back into client-ready PDFs. One flat fee. Fully air-gapped.

$1,999 / year • Flat fee • Offline license

Findings → Branded PDF

Select tickets. Download the report.

Stop copy-pasting findings into a Word template the night before delivery. Multi-select findings in the dashboard and generate a branded assessment PDF in one click.

Report → Findings

Clip a DOCX or PDF into tickets.

Upload a client report, highlight the finding text, and promote drafts into trackable tickets — the reverse workflow pentesters dread doing by hand.

Includes Core

No-code scanner connectors included.

Map Qualys, Nessus, Trivy, or any JSON/CSV export in the Adapter Builder — no custom parsers. When you outgrow engagements, upgrade to Pro for team automation.

Ready for the next engagement?

Instant offline license • Need team automation? See Pro

Common Questions

Is RiskRancher really 100% air-gapped?

Yes. RiskRancher is a single binary with zero external API calls. It stores everything in a local SQLite database on your own hardware.

What is the difference between CORE, Auditor, and PRO?

CORE is the free Apache 2.0 engine (ingest, tickets, no-code Adapter Builder). Auditor ($1,999/yr) adds findings↔branded report workflows for pentesters. PRO ($4,999/yr) adds auto-assign, exception pipelines, suppressions, and team automation.

How does the offline licensing work?

We use RSA-signed license keys. Your machine validates the signature locally using our public key—no internet ping required.

Can I import data from Qualys or Tenable?

Yes. Use the no-code Adapter Builder: upload a sample Qualys, Nessus, Trivy, or any JSON/CSV export, map title/asset/severity in the UI, and ingest. No custom parser code required.