Attestation letter

What it means

An attestation letter is a short document, normally one page, signed by the testing company. It states that a security test took place, on which application or systems, between which dates, and by what method. It may add a high-level result, such as whether any critical issues remain open.

It does not list findings or technical detail. Its purpose is to let you show a customer or auditor that a test happened without handing over a report that describes your weaknesses. The statement is only as good as the credibility of whoever signs it.

Why it matters

Buyers often ask for proof of a recent penetration test during a security review. Sharing a full report is risky, as it maps your weak points. A letter answers the question quickly and keeps the detail private. It can shorten a sales cycle by days. It is a courtesy to the buyer as much as protection for you, since it answers the real question fast.

Auditors and insurers may also accept it as supporting evidence, alongside the real report held on file. Used beside a security questionnaire, it answers whether you test and when, though it does not replace the full report. Keeping both on file means each question gets the right answer.

How it shows up

A good letter names the tested application, the scope, the dates, the testing approach, the company and the person signing, and the date of issue. It should say whether the findings were fixed and retested, which is where a retest report helps. Scope matters: a letter covering only one module cannot vouch for the whole product.

Be cautious with letters that say a system is secure or passed. No test can show that. A responsible letter describes what was done and what was found, within limits. Customers who read carefully will ask about the scope and whether open items remain, so be ready to answer.