FACTION is an open-source penetration testing report generation and assessment collaboration framework from OWASP, built for security consultancies, red teams, and internal assessment groups that need to turn raw findings into tracked, peer-reviewed client deliverables.

What it is

FACTION is a self-hostable application that packages an entire security assessment workflow into one system. It lives in the OWASP project ecosystem as OWASP Faction, is written in Java, and is released under the GPL-2.0 licence. The application provides automated generation of penetration testing and security assessment reports, structured peer review with change tracking, real-time collaboration between assessors through a web application and a Burp Suite extension, and organisation-wide management of assessment teams and their progress.

The concrete problem it addresses is the fragmentation of report production. Assessment findings normally get written up by hand in word processors, reviewed over email or chat, versioned badly, and then tracked separately in spreadsheets once the client starts remediating. FACTION replaces that manual assembly line with a single system: findings are captured against reusable vulnerability templates, assembled into customisable DOCX report templates for different assessment types and retests, reviewed and revised in place, and carried forward into remediation tracking with custom SLA warnings and alerts.

Key capabilities

• Automated generation of penetration testing and security assessment reports.
• Peer review and track-changes workflow on reports before they leave the team.
• Customisable DOCX report templates tailored to different assessment types and retests.
• Over 75 prepopulated vulnerability templates, loaded from Templates > Default Vulnerabilities via "Update from Faction".
• Real-time assessor collaboration through the web application and the Burp Suite extension at factionsecurity/Faction-Burp.
• Full REST API for integration with other tools, plus custom plugins modelled on Burp Extender and custom report variables.
• LDAP and OAuth 2.0 authentication, SMTP integration, and SLA warnings and alerts for remediation tracking.

Who uses it and how

• Security consultancies and internal assessment teams that need consistent report output across multiple assessors and multiple concurrent engagements.
• Assessors working in Burp Suite, who push findings into FACTION through the companion extension instead of re-keying them into a document later.
• Delivery managers and team leads who manage assessment teams and track progress across the organisation from one place.
• Remediation owners on the client side, who are tracked against custom SLA warnings and alerts after the report is delivered.
• Organisations with existing identity infrastructure, which can attach FACTION to their directory through LDAP or OAuth 2.0 and route notifications through their own SMTP server.
• Developers extending the platform with custom plugins and report variables rather than forking the application.

Getting started

Clone the repository and run docker-compose up --build; the containers expose the instance at http://127.0.0.1:8080, and on first boot FACTION prompts for creation of an admin account. Building the WAR file directly requires Java JDK11 and Maven.

How it compares

No paid commercial products are listed in the facts for this entry, so direct comparison is not possible here; FACTION stands alone in this registry on that basis. The nearest named tool is Burp Suite, and FACTION integrates with it through the Faction-Burp extension rather than competing with it. Distribution is governed by the GPL-2.0 licence, and the software is deployed and operated by the adopting organisation rather than delivered as a hosted service.

When to use it — and when not to

A self-hoster must operate MongoDB alongside the application container, and MongoDB requires a CPU with AVX support, which is a known obstacle on some virtualised, Oracle VirtualBox, and Kubernetes environments. Java JDK11 and Maven are needed for source builds, and SMTP, LDAP, or OAuth 2.0 are needed to get mail and directory login working. Note the version situation: this repository holds FACTION 1.X, and OWASP Faction 2.0 has been released in a separate repository and will replace it, so new adopters should evaluate the 2.0 line before committing to a 1.X deployment.