reconmap.com

What it is

Reconmap is an open-source vulnerability assessment and penetration testing management platform designed to help InfoSec professionals plan, execute, and document each stage of a penetration testing project. The documentation indicates that it supports multiple targets and multiple clients, making it suitable as a project collaboration and delivery management tool for security service providers or internal enterprise security teams, rather than a traditional automated firewall or endpoint protection product.

Core capabilities

Based on the documentation structure, Reconmap covers modules such as projects, clients, tasks, tools, commands, vulnerabilities, reports, and system administration. Its protection category is more accurately described as vulnerability management and penetration testing workflow management. It can be used to record vulnerability details, maintain vulnerability taxonomies, generate penetration testing reports, and support team collaboration through dashboards, documents, notes, and Markdown. For administration and alerting, the documentation mentions email notifications, audit logs, system health, user roles, project members, project access restrictions, and two-factor authentication, suggesting that it offers basic security governance capabilities.

Deployment, integrations, and pricing

Reconmap is presented as an open-source platform. Its documentation includes configuration guidance for Debian, Nginx, Let’s Encrypt, databases, SMTP, CORS, logs, network ports, and server hardening, indicating that it is primarily intended for self-hosted deployment. In terms of integrations, it provides capabilities such as API Tokens, Azure DevOps Integration, data import/export, a command-line interface, and tool and command management. The documentation does not disclose a cloud-hosted version, commercial subscriptions, SLA, compliance certifications, or specific pricing, so its pricing can only be understood as open source; commercial costs will depend on your own deployment, maintenance, and staffing requirements.

Pros, cons, and who it’s for

Its advantages are open-source transparency and relatively complete workflow coverage, making it suitable for teams that need to manage penetration testing delivery across multiple clients, projects, and members. Audit logs, two-factor authentication, and access restrictions also help improve management security. The limitations are that it appears to require self-deployment and maintenance, with certain expectations around Linux, web services, databases, and security hardening expertise. It also lacks clear information on commercial support, compliance certifications, and pricing, so it is not ideal for teams that simply want to purchase an out-of-the-box SaaS product.

Access from China

The documentation does not provide information about access from mainland China, payment methods, or localization support, so its access status can only be marked as unknown. If access to GitHub or external dependencies is unstable, self-hosted deployment may require preparing mirror sources or a network proxy. Possible alternatives include other open-source vulnerability management, penetration testing reporting, and security project management tools, but specific options should be evaluated against the team’s actual workflow.