Getting started

TrekShield is where you follow a penetration test from scoping to fixes and retests.

Accept your invitation

Accounts are created by invitation only; there is no public sign-up. Your TrekShield engagement manager or your organization’s Client Administrator sends an email with an invitation link. The link expires after 7 days; ask the sender to resend it if it lapses.

On the invitation page you enter your name and choose a password of 8 to 128 characters that includes a lowercase letter, an uppercase letter, a digit and a special character.

Sign in

Sign in with your email address and password. After five failed attempts the account locks for 15 minutes.

If an authenticator app (TOTP) is enabled on your account, you are asked for the 6-digit code after your password. A one-time recovery code works in its place. Recovery codes are shown once, when MFA is switched on.

The app signs you out after 30 minutes of inactivity and warns you two minutes before. Closing the browser tab also ends the session.

Sign-in uses your email address and password. The web app does not have screens for enrolling in an authenticator app, changing a password or requesting a reset, and there is no single sign-on (SSO). If you need a reset, see the FAQ.

Your dashboard

What you see depends on your role.

• Client Administrator sees Security Posture: items needing action (critical findings, SLA breaches, delivered engagements, pending risk-acceptance requests), finding and remediation KPIs, a risk score, burn-down, engagement schedule and a remediation funnel.
• Client User sees Security Overview, a read-only summary.
• Client Developer sees My Fix Queue, the remediations assigned to you.

The dashboard stays mostly empty until your first engagement is delivered. Your engagement manager sets the engagement up; findings appear to you after delivery. See the engagement lifecycle.

Find your way around

• Sidebar: Dashboard, Work (Engagements, Findings, Remediations, Retests; the list varies by role), Reports, and Attack Surface (launching soon). Client Administrators also see Team and Settings.
• Search: press Ctrl+K (⌘K on Mac) to search; queries need at least 3 characters. Ctrl+/ lists shortcuts.
• Notifications: the bell shows in-app notifications, which are always on. Client Administrators can choose which events also send email under Settings, Notifications: state changes, comments and mentions, assignments, SLA warnings.
• Profile: open it from the user menu to edit your display name or sign out.

Next steps

Read how findings and severity work, invite colleagues under team and roles, or see troubleshooting.