The most expensive object in penetration testing may be the report everyone stops using. A specialist spends days probing a network, then more days arranging screenshots and severity labels inside a handsome PDF. The client reads the executive summary, copies findings into another system and gets on with the messy work of repair. Six months later, the report is stale. A year later, the tester may find the same flaw again.
Dan DeCloss knew this ritual from both sides. He had tested systems at Veracode and the Mayo Clinic, advised Anthem and built a cybersecurity program at Scentsy. The hacking was a puzzle. The reporting was clerical drag. Worse, the deliverable severed the people who found a weakness from the people expected to fix it.
So DeCloss began writing software. PlexTrac started around 2016 as a bootstrapped side project in Boise, Idaho, while he still had a day job and a family. The first job was narrow: make pentest reports faster to produce and useful after delivery. The larger company emerged when peers validated the pain, customers appeared and those customers pulled the product into assessments, collaboration and purple-team work. DeCloss has said the business eventually suffered because he could not give it full attention. That was the signal to leave the side-gig phase behind.
“I hated writing reports after a pentest.”Dan DeCloss, founder
The document was the first failure
PlexTrac did not invent vulnerability scanning, ticketing or red teaming. Its bet was that the awkward space between those categories deserved its own system. The platform ingests findings from pentests, scanners, bug-bounty programs and assessments. Teams can standardize reusable descriptions and recommendations, attach affected assets, produce tailored reports, assign owners, monitor status and retest. Dashboards translate the pile into progress a security leader can discuss with engineers or a board.
Its modules reflect that expansion: Reports and a Content Library for reusable work; Assessments for framework-based questionnaires; Runbooks for repeatable offensive procedures; Analytics for trends and service levels; Priorities for contextual scoring; and Scheduler for engagement capacity. Integrations with Jira, ServiceNow, Qualys, Rapid7, CrowdStrike, Microsoft and Cobalt keep PlexTrac from becoming yet another isolated screen.
That last point is the difference. A scanner tells a team what it detected. Jira tracks work. A document generator packages prose. PlexTrac sits across the handoffs, especially for offensive-security teams whose evidence does not fit neatly into automated scanner output. Its configurable risk equations let a customer weight technical severity against business context instead of treating every identical CVE as equally urgent everywhere.
A time machine sold by subscription
PlexTrac sells B2B software to enterprise security teams, consultancies, managed security service providers and managed service providers. Packages are labeled Essential, Core and Premium for service providers and enterprises. Public list prices do not exist; buyers request a quote. Plex AI can be an add-on and only works with the cloud-based product. The acquisition price Brinqa paid is also undisclosed. Those omissions make an honest cost comparison impossible.
The customer economics are easier to see. Core Networks, a Connecticut security consultancy, says reusable reporting and automation let it comfortably schedule 50 to 100 percent more pentest engagements. Another testimonial on PlexTrac’s site describes more than 20 hours saved on reporting for large assessments. In its 2022 funding announcement, PlexTrac cited customer reports of five-times first-year ROI, a 30 percent efficiency increase and a 65 percent shorter reporting cycle. These are company-selected customer claims, not controlled measurements, but the mechanism is credible: fewer expert hours spent wrestling formatting means more hours available for testing or another client.
Investors paid to widen the wedge. StageDotO backed the seed round in 2019. A $10 million Series A arrived in April 2021 from Noro-Moseley Partners and Madrona Venture Group, with StageDotO participating. Ten months later, Insight Partners led a $70 million Series B. PlexTrac said recurring revenue had tripled and headcount had quadrupled during 2021. The money funded hiring, market reach and a product roadmap that increasingly used the language of continuous threat exposure management, or CTEM.
AI arrived after the workflow
In 2024, PlexTrac added Plex AI, real-time editing and scheduling. The assistant, built on Google Cloud’s Vertex AI, can draft finding descriptions, remediation steps and report narratives. The useful design choice is that it lives inside an existing review process. Multiple practitioners can edit at once, while role-based access controls govern what the AI components can reach. PlexTrac says customer data is not mixed across companies or used to train a shared customer model.
The lesson is not to sprinkle a chatbot over an old product. PlexTrac first collected structured findings, reusable language, asset context and remediation state. AI then had a bounded job: accelerate authoring and summarize themes. In March 2026 the company introduced a Model Context Protocol connection so customers could bring approved assistants to live PlexTrac data without manual exports. The feature followed the data model; it did not create it.
Find the expert artifact that dies at handoff. Save its reusable parts, attach ownership and status, connect the system where downstream work already happens, and measure cycle time. Add generative AI only when the source data and human review path are already clear.
Partnerships extended the same thesis. Cobalt findings can flow into PlexTrac for reporting and remediation. ServiceNow integrations create and synchronize incidents or risk work from PlexTrac findings. Google Cloud supplies the AI infrastructure. Each connection reduces a copy-and-paste seam where context can vanish.
Built in Boise, not in a lab
The company’s personality begins with a founder who came to security through formal training, not bedroom hacking mythology. DeCloss studied computer science, earned a master’s degree with a cybersecurity emphasis at the Naval Postgraduate School and worked for the Department of Defense. His entrepreneurial apprenticeship was less glamorous: in high school, he and his professor father built portable batting cages and tried selling them online. PlexTrac inherited that practical streak. Find the thing people keep rebuilding, make it reusable and see whether anybody pays.
Even the name is mechanical. “Plex” comes from plexus, a fully meshed network; “Trac” is the job of following findings through repair. The company’s public values are aggressive innovation, integrity through transparency and accountability, and positively impacting people. Its careers page advertises flexible office, home or hybrid work, equity options, health coverage and retirement plans. Those are the company’s claims, not a guarantee of any employee’s experience, but they describe the organization PlexTrac wanted to project from its downtown Boise headquarters.
Leadership also matured past the founder-does-everything phase. Andy Langsam became chief executive in June 2023, bringing go-to-market experience with service providers and enterprises. DeCloss shifted toward product, customers and brand, eventually taking the title Chief Customer Brand Officer. That division matters: PlexTrac’s technical credibility still rests on a practitioner’s scar tissue, while selling a multi-module platform to large organizations requires a different operating muscle.
Brinqa bought proof of repair
By 2025, PlexTrac was describing itself as an exposure assessment platform, not merely pentest-report software. Gartner placed it as a Niche Player in its first Magic Quadrant for that category. In June 2026, The Hacker News named it Best Exposure Assessment Platform in its Cybersecurity Stars Awards. Then, on August 19, Brinqa acquired the company.
The strategic logic is clean. Brinqa aggregates exposure data from scanners, cloud systems and application-security tools, then helps enterprises decide what matters. PlexTrac brings the offensive practitioner’s evidence: the manual test, the workflow, the report and the retest that confirms a remediation held. Together, the companies say they serve more than 3,000 customers in 57 countries, including more than a quarter of the Fortune 500. That is a combined figure, not PlexTrac’s standalone customer count.
The acquisition also gives PlexTrac a larger home in a crowded market. Reporting specialists such as Dradis and AttackForge address parts of its original use case. Nucleus Security, Tenable, Qualys, Rapid7 and Cisco’s vulnerability-management products compete around aggregation and prioritization. ServiceNow and Jira own broad workflow territory. PlexTrac’s defensible corner is the practitioner-built bridge from hands-on assessment to verified repair.
The scanner found it. The ticket moved it. The retest proved it.The product logic behind the Brinqa deal
When the playbook does not travel
Not every security team needs this machinery. A small consultancy running a handful of assessments may be faster with disciplined templates and a ticket tracker. A company that cannot standardize findings, identify owners or connect source tools can end up buying an expensive new place for old disorder. If the security program performs only annual point-in-time testing, the continuous-exposure pitch loses force. And an organization requiring local deployment cannot use Plex AI, which requires PlexTrac’s cloud version.
There is a subtler risk in any platform that promises one view of risk: the score can look more objective than it is. Contextual equations are useful precisely because priorities differ, but somebody must choose the weights, maintain asset context and challenge convenient answers. Automation shortens the queue; it does not decide a company’s appetite for failure.
Still, PlexTrac’s path is unusually legible. The first failure was a report that became obsolete upon delivery. Customer demand changed a side project into a company and pulled it beyond reporting. Venture money accelerated the expansion. Brinqa then bought the last operational mile it lacked. The portable idea is modest and powerful: do not automate the document alone. Follow the work until the loop closes.