SecReport

SecAegis is a small team that builds security tooling for Chinese SMEs, and SecReport reflects that focus clearly. The product's core claim is that security report writing is repetitive work that a shared, template-bound editor can absorb — vulnerability write-ups, APP privacy compliance findings, version history, permissions — so analysts spend their hours on analysis instead of formatting. That is a real problem in outsourced pen testing shops, where three testers on one engagement routinely merge findings into one client deliverable and version drift is a common cause of embarrassment. The pricing table is unusually concrete for this category and worth reading closely, because the tiers differ on dimensions that matter beyond seat count. The community edition is free forever but licensed for non-commercial technical exchange only, and offline activation is not supported — so a shop that wants to run it internally without a subscription is reading the wrong row. The official cloud version is currently 限时免费 with unlimited reports and five users, which is a genuinely useful way to evaluate the platform before paying. Basic at ¥700/mo caps you at 10 reports and 10 users, with SSO unsupported; that report ceiling is low enough that a team doing more than a couple of engagements per month will hit it. Standard at ¥2,000/mo is the tier the vendor clearly expects most mid-sized teams to land on: 20 users, 500 reports, SSO included, weekday support. Advanced removes seat and report caps, adds offline activation and 7×24 support, and is quote-only. Discount mechanics are published: first month free by contacting a sales consultant, two months off on annual prepay, and a free custom report template consulting session with an annual subscription. The annual discount means the effective month-to-month rate is lower than the headline, but you are committing a year to get it. The honest constraints: only two report types are supported, everything is cloud-hosted on the paid tiers (no offline activation below Advanced), and no integrations are documented in the scraped content — not because none exist, but because the integrations page was not reachable this run. Do not read that as an absence. If your workflow needs to pull findings directly from Burp, Nessus or a scanner API, ask the vendor directly rather than assuming. Where it fits: a Chinese pen testing or APP compliance shop with 5–20 analysts, writing recurring client reports in Chinese, that wants shared editing and templates without building them. Where it doesn't: English-language consultancies, enterprises that need self-hosted deployment on day one, and teams whose reporting spans vulnerability assessment, cloud posture, red team ops and incident response — SecReport covers two of those and you would be stitching the rest in another tool.