We only ship what we can prove.
A scanner hands you a wall of maybes. Notra evaluates candidates with a verification gate and ships findings with supporting evidence when the gate passes, scored and written so a non-engineer can act on them. The rest is noise, and noise is the reason most security reports get filed and forgotten.
Most vulnerability scanners optimise for coverage: they list everything that might be a problem and leave you to sort truth from theory. For a small team with no security hire, that’s worse than nothing, a 400-item PDF that nobody can triage becomes a document you file and forget, right up until the breach.
The thesis: verified, not voluminous
Notra runs the same broad scan, then evaluates candidates through a verification gate. Where supported, we try a benign proof, such as integer math instead of a shell or an empty folder instead of an upload. Low-confidence candidates are withheld. Findings that pass may include captured request and response evidence, a severity score adjusted for real-world context (is it internet-exposed, is it on CISA’s Known Exploited list), and a plain fix. The bar we hold our own surface to is written down in our security posture.
Honest by construction
Our probes are non-destructive by default and never touch money-movement endpoints without explicit, sandboxed consent. We check ownership before active probing and disclose what the run did and did not cover. The report page is a fictional illustration for explaining the workflow, not an independently reviewed customer engagement. Trust is the product.
Read before you buy
We write up how the gate works, what we cut, and what we’re still bad at on the blog. The demo scan and the free scorecard illustrate the workflow and scope of the paid audits, so you can evaluate the approach before you pay for anything.
Who it’s for
Founders shipping without a security team, agencies who need a report their clients will actually read, and MSPs standardising audits across a roster. If you’ve ever paid for a pentest and couldn’t tell which findings were real, Notra is the answer to that.
See the bar for yourself.
Run the free scorecard on your own site. If the report reads like something you'd forward to a developer, we're doing our job.