Fleetfolio

Fleetfolio is a specialized service layer inside the broader Opsfolio and Opsfolio Compliance-as-a-Service (CaaS) ecosystem. It is built for organizations that need a repeatable, evidence-driven approach to discovering, evaluating, and operationally validating their external-facing digital assets — compressing traditional penetration testing timelines from weeks to hours, while producing audit-ready evidence at every step.

Fleetfolio is built around two tightly integrated capabilities:

• Fleetfolio Pentest — The technical assessment engine that runs structured penetration testing and asset discovery workflows using 34+ open-source tools.
• Fleetfolio Threat Exposure — The reporting, dashboards, and communications layer that transforms raw findings into actionable workflows and executive insights.

Together, they form the foundation for continuous threat exposure management through Operational Acceptance Testing (OAT) — making it accessible to both non-technical users running assessments and security professionals interpreting, validating, and acting on results.

Fleetfolio Pentest

Fleetfolio Pentest is the core assessment capability of the platform. It provides a reusable, auditable, and compliance-aligned engine for discovering, evaluating, and operationally validating external-facing enterprise assets — running continuously or on-demand without significant operational overhead.

Fleetfolio Pentest contributes to both UAT and OAT:

• Supports UAT by validating application behavior, workflows, and expected outputs
• Enables OAT by generating real-world security findings that require analyst validation for exploitability and operational impact

What Makes It Different

• Non-technical friendly: Even users without a security background can trigger assessments. Security professionals then review, validate, and interpret results — with automated report generation reducing manual effort and human error.
• Fast: Traditional penetration testing can take weeks. Fleetfolio reduces this to hours while still producing comprehensive, structured outputs.
• Portable: Docker-based deployment means it runs anywhere — on-premises, in CI/CD pipelines, or scheduled via cron jobs.
• Open and extensible: Leverages 34+ open-source security tools, reducing dependency on expensive proprietary solutions. Results from third-party or paid tools can also be imported and unified in the same dashboard.

How It Works

Result Structure

Every assessment produces a consistent, timestamped directory of artifacts:

results/
├── 2026-03-04T10-20-10/
│   └── *.sqlite.db
├── 2026-03-04T11-05-30/
│   └── *.sqlite.db

Each run generates a SQLite database storing all findings, which powers visual dashboards via the Surveilr web UI. External findings from paid or open-source tools can be imported by placing outputs in markdown, JSON, JSONL, or TXT format into a timestamped folder and regenerating the database — no complex pipelines required.

Assessment Tools

The Spry runbook (fleetfolio-eaa-pentest-lite.spry.md) orchestrates 34+ tools across the following stages:

Fleetfolio Threat Exposure

Fleetfolio Threat Exposure is the Operational Acceptance Testing (OAT) layer of the platform.

It ensures that security findings are validated in real-world operational contexts — transforming raw technical results into actionable insights, risk-informed decisions, and measurable outcomes.

Security assessments are only valuable when validated through Operational Acceptance Testing (OAT) — ensuring findings translate into real-world action and risk reduction.

Fleetfolio Threat Exposure solves this with a real-time, evidence-driven reporting and communications layer that transforms technical findings into actionable dashboards, automated workflows, and executive insights.

From Feature Validation to Operational Reality

Traditional approaches focus heavily on UAT — verifying that systems behave as expected.

Fleetfolio extends this by enabling OAT — validating whether systems are secure, resilient, and reliable under real-world conditions.

This shift ensures organizations move beyond feature correctness to true operational security.

How Pentest & Threat Exposure Work Together

Customer Benefits

Relationship to Opsfolio

• Fleetfolio Pentest contributes structured artifacts (JSON, JSONL, XML, SQLite) to the Opsfolio evidence warehouse.
• Fleetfolio Threat Exposure provides the customer-facing UI/UX for reporting, dashboards, and workflow automation.
• Opsfolio CaaS uses both to generate Plans of Actions and Milestones (POA&M) for regulated industries — linking threat evidence directly to compliance frameworks including SOC2, ISO, CMMC, HIPAA, and FedRAMP.