PMAP
Istanbul, Turkey
What it is
PMAP is an API-delivered enterprise vulnerability management platform and multi-vendor scan orchestrator. It connects 30 vendor connectors across nine categories, including vulnerability scanners, DAST, SAST, SCA, ITSM, and CI/CD. Users can launch, schedule, import, pause, resume, and stop scans, with live status synchronization. PMAP matches findings by scanner references and SHA-1 fingerprints, deduplicates issues across scanners, and can reopen closed findings while retaining status history. Findings follow an enforced lifecycle with owners, severity-based SLAs, escalation, and optional four-eyes closure approval. Holding-company and subsidiary structures use scoped tenants, custom roles, and a 10-entity by 6-action permission matrix. Ticketing integrations include Jira, ServiceNow, and ManageEngine; CI/CD options include GitHub, GitLab, Jenkins, Azure DevOps, Bamboo, and Bitbucket. Dashboards, risk scoring, and six report types support analysis. Reports can be PDF, DOCX, or HTML, with SHA-256 signing and QR verification. Pricing is paid and available on request.
For and against
For
- 30 vendor connectors across nine categories
- Deduplicates findings using scanner and SHA-1 matches
- Enforced remediation lifecycle with SLAs
- Multi-tenant roles and scoped boundaries
- Signed reports support QR verification
Against
- API is the listed platform
- Enterprise-oriented workflows may exceed small-team needs
The verdict
PMAP combines scan orchestration, finding correlation, remediation controls, and reporting in one platform. Its multi-tenant governance is particularly relevant to complex enterprise structures.
Who it suits
It suits enterprise security teams coordinating scanners and remediation across holding companies or subsidiaries. Managed providers, resellers, integrators, and consulting or pentest firms are also listed audiences.
On the record
- Audience
- PMAP describes itself as built for enterprise security teams and organizations managing a holding company and subsidiaries.pmap.io · read 7 Oct 2026
- Availability and sales
- The site invites prospective customers to request a demo; the pricing URL did not provide an accessible pricing page.pmap.io · read 7 Oct 2026
- Compliance posture
- PMAP lists SOC 2 Type II as in progress, ISO 27001 controls as aligned, and GDPR readiness with regional data residency.pmap.io · read 7 Oct 2026
- Correlation
- PMAP matches findings by scanner reference and SHA-1 fingerprint, deduplicates across scanners, and can reopen closed findings while preserving status history.pmap.io · read 7 Oct 2026
- Deduplication
- PMAP matches scanner results against existing findings and says fingerprint matching can merge the same issue found by different scanners on the same asset.pmap.io · read 7 Oct 2026
- Disclosure policy
- Privia Security Ltd publishes a responsible disclosure policy that invites vulnerability reports and describes its handling commitments.pmap.io · read 7 Oct 2026
- Integrations
- PMAP creates and syncs tickets with Jira, ServiceNow, and ManageEngine, and can gate CI/CD pull requests on new critical or high findings.pmap.io · read 7 Oct 2026
- Intended users
- PMAP says it is built for enterprise security teams and describes partner tracks for managed providers, resellers, system integrators, and consulting or pentest firms.pmap.io · read 7 Oct 2026
- Multi-tenancy
- PMAP says it supports a holding company and subsidiaries with scoped data, role-based access, SLA thresholds, and four-eye approvals.pmap.io · read 7 Oct 2026
- Multi-tenancy and access
- PMAP supports holding-company and subsidiary hierarchies, scoped tenant boundaries, custom roles, and a 10-entity by 6-action permission matrix.pmap.io · read 7 Oct 2026
- Pricing availability
- The pages reviewed direct prospective customers to request a demo and do not state a PMAP subscription price.pmap.io · read 7 Oct 2026
- Purpose
- PMAP is an enterprise vulnerability management platform that ingests scanner results, correlates findings, and tracks remediation.pmap.io · read 7 Oct 2026
- Remediation workflow
- PMAP applies ownership and SLA deadlines to findings and provides an enforced lifecycle with audit-logged status transitions.pmap.io · read 7 Oct 2026
- Reporting
- PMAP generates scheduled PDF, DOCX, and HTML reports and says signed reports include a SHA-256 hash and QR verification link.pmap.io · read 7 Oct 2026
- Report integrity
- PMAP reports can be signed with a SHA-256 integrity hash and verified through a public QR endpoint.pmap.io · read 7 Oct 2026
- Reports and analytics
- PMAP provides configurable dashboards, risk scoring, and six report types generated as PDF, DOCX, or HTML.pmap.io · read 7 Oct 2026
- Sales and evaluation
- The site directs prospective customers to request a demo and says a scoped technical evaluation against their own scanners can be discussed.pmap.io · read 7 Oct 2026
- Scan management
- Users can launch, schedule, import, pause, resume, and stop scans from PMAP, with live status sync for running scans.pmap.io · read 7 Oct 2026
