Home / Knowledge hub / Penetration test report
Knowledge hub
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
What it means
A penetration test report is the written result of a penetration test. It records what was tested, how the testing was done, what was found, how serious each finding is and what to do about it. It is the thing you keep, share with customers and use to plan fixes.
Most reports have two layers. An executive summary tells decision makers where they stand in plain words. The technical findings give engineers the detail to reproduce and fix each issue. PCI guidance on penetration testing sets out the same elements, including scope, method and results.
Why it matters
The report is the product. A test that finds good things and writes them badly changes nothing, because nobody can act on it. A clear report lets a developer fix a flaw without a call, lets a manager see priorities, and lets a customer judge your security without hours of questions.
It is also evidence for audits and sales. Enterprise buyers and frameworks such as PCI DSS and SOC 2 commonly ask for a recent report, or a summary of one. A report padded with scanner output and generic advice invites more questions than it answers.
How it shows up
A good report states the scope and dates, the method and any limits, a short summary, and then each finding with a title, rating, location, reproduction steps, evidence and fix advice. It should separate confirmed findings from unconfirmed ones, and name the weakness type with a CWE reference.
Poor reports are easy to spot. They are mostly tool output, they use copied advisory text, their severity cannot be explained, and they offer no way to repeat the steps. Ask whether an engineer could reproduce each finding from the page alone, and whether there is an attestation letter you can share.
Questions people ask
Penetration test report, answered
What should a penetration test report include?
Scope, dates, method, an executive summary, a list of findings with severity and evidence, reproduction steps, fix advice and any limits of the test.
A methodology section helps readers trust the results.
How long is a typical pentest report?
It varies with the size of the application and the number of findings. A small app may produce a dozen pages, a large one many more.
Length matters less than whether each finding is clear and reproducible.
Can I share the full report with customers?
Usually not the full report, since it describes weaknesses in detail. Share the executive summary or an attestation letter instead.
Some customers sign an NDA to see more. An attestation letter is the usual middle path for first-line reviews.
How often should I get one?
At least yearly and after major changes is common, and PCI DSS asks for testing at least yearly and after significant change.
Teams that ship often add continuous testing between reports.
What is the difference between a pentest report and a scan report?
A scan report lists what a tool matched. A pentest report lists what a tester actually used, with evidence.
The pentest report is shorter and carries fewer false alarms. You also get reproduction steps, which a scan list rarely has.
Related
Terms that sit next to this one
Executive summary
The one-page version of a security report written for non-technical decision makers.
Attestation letter
A short signed statement that a test was done, for customers or auditors.
Retest report
A short report confirming which earlier findings are now closed and which remain.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Compliance report
A report shaped to show an auditor that a required test or control was done.
Could your engineers act on it?
Our reports carry the request, the response, a screenshot where a person can see it and the line of code, with severity and confidence kept apart. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.