The penetration testing report

A strong penetration testing report works for two audiences at once — leadership and engineers:

• Executive summary — the overall risk, the top handful of issues, and what to do, in language a director can act on.
• Scope and methodology — exactly what was tested, from what perspective, against which standards.
• Findings — each with a severity rating, reproducible evidence, business impact, and specific remediation.
• Remediation plan — findings prioritised by risk and effort, with owners and timelines.
• Retest — validation that the fixes actually closed the gaps.

Public guidance agrees on the core. The NCSC’s penetration testing guidance says findings should carry a severity rating. The NCSC’s CHECK Scheme Standard, written for public sector testing, requires reports to state each risk level and to open with an executive summary written for non-technical readers. CREST’s Defensible Penetration Test guidance suggests each finding carries a CVSS severity score and remediation advice, which makes results comparable between tests and firms.

If a report uses CVSS, you can check or recalculate a score with the free CVSS 4.0 and CVSS 3.1 calculators.

Ask a prospective firm for a redacted sample report. The tells of a good one: findings that explain what an attacker could do, not just what is technically wrong; evidence you could hand to an engineer to reproduce; remediation that is concrete rather than “apply best practice”; and an executive summary that a non-technical leader could read and act on. A report that is mostly raw scanner output is the sign of a light, automated test.

The downloadable template above gives you a neutral, standards-aware structure to adapt — useful for agreeing the deliverable format with a firm before testing starts, so the final report matches what your auditors, customers, or board actually need. If the report is for a standard, check what it asks for: PCI DSS, ISO 27001 and SOC 2 each have their own guide.