The PwnDoc Alternative
With AI Built In.

Reporting is where engagements slow down. PwnDoc-ng's answer is a hand-written workflow. There is no LLM integration, no narrative drafting, no remediation suggestion. Every executive summary, finding description, and reproduction step is written from scratch.

Neuron's AI runs on your hardware. The whole model. It drafts findings from a one-sentence prompt, pulling approved Risk Statements and Remediation Guidance directly from your library. Prompts, context, and output all stay inside your network.

Hand-written reporting is a choice. With Neuron, it does not have to be.

The original PwnDoc was declared inactive by its maintainer in early 2023. PwnDoc-ng is the active fork, but the most recent tagged release is v0.5.5 from February 2023. Master-branch development continues with a small volunteer group. No release cadence, no support tier, no SLA.

That puts the install, the database, the upgrade path, and every patch on your team. CVEs in the project itself and in the underlying template-rendering library land on you to track and remediate. The night before a deliverable, the phone number you call is your own.

Neuron is vendor-supported. Patches ship from us. Upgrades are a single binary swap. When something breaks, the phone number is ours.

PwnDoc-ng covers audits, a vulnerability database, and DOCX export. Everything around it is on you: engagement scheduling, asset and credential tracking, a client portal with audit trail, native scanner imports, a Burp extension, AD attack path graphing. None of those ship.

For firms running multiple engagements a week, stitching the workflow around a report generator becomes its own project. Neuron is the engagement platform with the report as one part.

PwnDoc-ng inherits its retest code from upstream PwnDoc, where it is undocumented. A user opened a public GitHub issue in October 2023 asking whether anyone was actually using the retest functionality and noting they could not find documentation to guide them. The issue is still open. Engagement scheduling is not in the product at all.

Neuron treats both as platform primitives. Retests are round-based first-class records under the same engagement, with per-finding outcomes (Resolved, Partially Resolved, Not Resolved, Risk Accepted, No Retest Performed), peer cosign gated by severity policy, round-locked audit integrity, and per-assessment evidence schemas. Once a round moves to ready for approval, per-finding mutations freeze. Every state change writes a QA log entry with actor, timestamp, and prior state.

The schedule is a Gantt the team runs from. Drag bars to reschedule, drop on a tester to reassign, switch between me, users, teams, by-client, and by-engagement perspectives without leaving the view. Real-time capacity conflict detection surfaces overload day counts, peak concurrent counts, and a next-free window calculation. The Health Dashboard ranks twelve categories of risk before they hit kickoff. Retests appear as first-class allocatable scope on the Gantt alongside phases and assessments.