Reconmap review
A free, open-source hub for coordinating pentest projects, findings, evidence, and reports.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Reconmap is an open-source collaboration platform for information-security professionals who plan, execute, and document penetration tests. It brings project and client management, vulnerability tracking, evidence attachments, reporting, and security-command automation into one workspace. Teams working across multiple assets and clients can use it to organize engagements, manage findings, and produce reports from a shared system. The free, open-source core and self-hosted deployment model make it a practical fit for organizations that want control over their pentest coordination environment.
Its strongest area is the connection between test execution and engagement management. Reconmap supports automated and scheduled commands, web and network testing workflows, finding tracking, customizable report templates, attachments for projects, vulnerabilities, and tasks, audit logging, and analytics. Integrations include Jira, Azure DevOps, webhooks, Nmap, Semgrep, Snyk, Trivy, Subfinder, Syft, Testssl.sh, Bandit, gosec, Shcheck, and Generic LLM. REST API access, API-token authentication, SSO/SAML, and two-factor authentication add useful options for connecting the platform with existing security and delivery processes.
Deployment flexibility is a clear consideration. Reconmap can run through Docker Compose, Kubernetes, or manual installation, so teams should expect infrastructure and maintenance responsibilities when choosing self-hosting. A hosted SaaS option is offered separately by Netfoe. Reconmap is a strong choice for teams seeking free, open-source coordination across penetration-test projects, commands, findings, evidence, and reporting. Organizations looking primarily for a specialized API or mobile testing workflow should compare alternatives focused on those areas.
Reconmap pros and cons
- Where it wins
- Free, open-source core with self-hosted deployment options
- Automates security commands and supports scheduled tasks
- Tracks findings, evidence, attachments, and customizable reports
- Where it doesn't
- Self-hosting requires Docker Compose, Kubernetes, or manual installation
- The hosted SaaS option is provided separately by Netfoe
- Its documented focus is web and network testing workflows
Reconmap fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update