What’s in a report?

A good report reads at two levels. An executive summary states, in plain language, what was tested, what was found, the overall risk level and the priorities. A technical section covers each finding for the teams who will fix it. The same document serves the decision-maker and the engineer.

For every finding you get the same headings, so nothing is left to guesswork:

• The proof: a screenshot or trace showing the flaw is real, not theoretical.
• The severity: a level based on the CVSS score or an agreed scale, taking your context into account.
• The exploitation scenario: how an attacker would use it, and how far they would get.
• The reproduction: the steps to find the flaw yourself.
• The fix: a realistic recommendation adapted to your constraints, not a generic copy-paste.

Findings are ranked by severity and by fixing effort, so your teams know what to tackle first. The goal is not to lengthen the list, but to make every line actionable. Critical vulnerabilities are flagged to you during the engagement, without waiting for the report.

Once the fixes are applied, I check they are effective and update the report. You then get a document that no longer just says “here are the flaws”, but “here are the flaws, and here they are fixed”: this version is the evidence you can show a client, an insurer or an auditor. For the full process, see what is a penetration test and the penetration testing service.

Want to see what a report looks like on your scope? Describe your need and I’ll explain exactly what you will receive.