What is a pentest report?

Imagine you’ve engaged a security vendor for a penetration test. You negotiated the rules of engagement, set a timeline and the vendor finished their testing. The vendor informs you they will be sharing the pentest report next week. What is a pentest report and how do I know if I’ve been handed a quality one?

Let’s go over some things to look for in your report to help answer these questions!

A penetration test (or pentest) report is how a penetration testing team communicates the process and results of a penetration test. The vulnerabilities discovered during the test are documented of course, but a good report includes much more than just the cool hacking activity.

A quality penetration test report will document key elements of the test structure, including the scope and rules of engagement. The report notes the dates and times when technical testing occurred, and highlights technical testing that was included or excluded, such as social engineering or phishing. An individual who picks up the pentest report a year after the test should be able to reconstruct the test details just by reading the report.

A good report clearly describe the test findings. It includes illustrative screenshots to demonstrate a vulnerability is and was practically exploitable and not just theoretical. The penetration testing team outlines their reasoning behind why a documented behavior is a vulnerability in the first place – including the risk and potential for loss that each vulnerability represents.

Look for risk scores for each vulnerability. No organization has the bandwidth to fix everything immediately, so the penetration testing team’s estimation of risk helps you decide which findings to prioritize for remediation. A good penetration test report won’t just list the issues, but will also include recommended ways to address them, giving you a head start in the remediation process.

Finally, check if the report has an executive summary. Reading through the technical details can take time, so having a quick summary that highlights the important takeaways can help stakeholders stay informed while making the best use of their time.

Want to see a pentest report in action? We have released a sample showcasing what you can expect from an UltraStrike penetration test report and you can download it for free today!

Have a network that needs tested? Need to know what risks your application is exposed to? Contact us today to see how an UltraStrike penetration test can help!