Ghostwriter

At a glance

• Editor score
  6.2 / 10
• Pricing
  Free plan
• Best for
  Free collaborative pentest reporting
• Free plan
  Yes
• Paid from
  Free
• Deployment
  On-prem
• Facts checked
  20 Sep 2026

• Where it wins

  • Collaborative editing with reusable findings and report templates
  • Evidence handling plus DOCX, XLSX, PPTX, and JSON exports
  • SSO, MFA, RBAC, GraphQL API, and selected security-tool integrations

• Where it doesn't

  • Requires user-managed, on-premises deployment
  • Focused on management and reporting rather than test execution
  • Integration coverage is limited to selected tools and services

Our verdict on Ghostwriter

Ghostwriter is an open-source platform for red teams and security consultants managing offensive-security engagements. It brings client and contact records, project and assessment management, domain and server infrastructure tracking, findings management, evidence attachments, and report production into one workspace. The free model makes it a fit for teams that want collaborative pentest reporting without adopting a hosted SaaS product. It is also relevant to organizations that need control over deployment and administration.

The reporting workflow is its clearest strength. Teams can edit reports collaboratively, maintain a reusable findings library, attach evidence files, and generate reports in DOCX, XLSX, PPTX, and JSON formats. Customizable templates support repeatable deliverables across assessments, while the GraphQL API provides a way to connect Ghostwriter with surrounding workflows. Integrations with Mythic C2, Cobalt Strike, Slack, and VirusTotal extend its place in an offensive-security toolchain, although the integration set is focused rather than broad.

Ghostwriter also includes role-based access controls, single sign-on, and multi-factor authentication, which give teams administrative controls for shared project and reporting work. Deployment is on-premises and user-managed, so the product suits organizations prepared to operate their own environment rather than teams seeking a vendor-hosted service. Its scope is important: Ghostwriter centers on project management, evidence, findings, and reporting. Teams looking for software that independently performs web, API, network, or mobile penetration testing should choose a different tool or pair Ghostwriter with dedicated testing products. Pick Ghostwriter when collaborative reporting and engagement organization are the priority.

Your product? Our editors can test Ghostwriter in depth and publish a review, labelled as paid · from $149/mo →

Ghostwriter pricing

Ghostwriter fact sheet

Ghostwriter integrations

Ghostwriter lists 4 integrations on its own site.

• Mythic C2
• Cobalt Strike
• Slack
• VirusTotal

Alternatives to Ghostwriter

• PPentesterraBroad automated penetration testing with a free plan and €23 monthly entry tier.9.3
• PentiBroad AI-led testing with human validation, evidence, retesting, and compliance reporting.9.1
• CICore ImpactA broad on-premise toolkit for repeatable infrastructure, web, client-side, wireless and mobile testing.8.9

See all Ghostwriter alternatives →

Featured on iTechGuides

Ghostwriter is listed in our Penetration Testing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/ghostwriter-penetration-testing-software/"><img src="https://www.itechguides.com/best/badge/ghostwriter-penetration-testing-software.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update