We only ship what we can prove.

Most vulnerability scanners optimise for coverage: they list everything that might be a problem and leave you to sort truth from theory. For a small team with no security hire, that’s worse than nothing, a 400-item PDF that nobody can triage becomes a document you file and forget, right up until the breach.

The thesis: verified, not voluminous

Notra runs the same broad scan, then puts every candidate through a verification gate. We try to reproduce the finding with a benign proof, integer math instead of a shell, an empty folder instead of an upload. Whatever we can’t prove, we cut. What survives comes with the exact request and response that demonstrates it, a severity score adjusted for real-world context (is it internet-exposed, is it on CISA’s Known Exploited list), and a plain fix. The bar we hold our own surface to is written down in our security posture.

Honest by construction

Our probes are non-destructive by default and never touch money-movement endpoints without explicit, sandboxed consent. We prove your site is yours before we scan it. And we tell you what we didn’t do, the demo report leaves its benign test artifact in place so you can confirm it independently, then delete it. Trust is the product.

Read before you buy

We write up how the gate works, what we cut, and what we’re still bad at on the blog. The demo scan and the free scorecard use the same engine as the paid audits, so you can see exactly what you’d get before you pay for anything.

Who it’s for

Founders shipping without a security team, agencies who need a report their clients will actually read, and MSPs standardising audits across a roster. If you’ve ever paid for a pentest and couldn’t tell which findings were real, Notra is the answer to that.