# Penetration Test Report — Template

> A neutral, reusable structure for a penetration testing report. Adapt to your
> engagement. Provided free by PenTesting.org — an independent directory, not a
> testing firm. Not legal or compliance advice.

---

## 1. Executive summary
- Engagement overview (what was tested, when, by whom)
- Overall risk rating and a one-paragraph plain-English verdict for management
- Count of findings by severity (Critical / High / Medium / Low / Informational)
- Top 3–5 risks and their business impact
- Summary of recommended actions and priorities

## 2. Scope and approach
- In-scope assets (URLs, IP ranges, applications, roles) — explicit and complete
- Explicitly out-of-scope items
- Test type (external / internal / web app / API / etc.) and perspective (unauthenticated / authenticated)
- Methodology and standards referenced (e.g. OWASP, PTES)
- Dates, testing window, and any constraints or rules of engagement

## 3. Findings
For each finding:
- **Title**
- **Severity** (with the rating method used, e.g. CVSS v3.1 / v4.0 vector and score)
- **Affected asset(s)**
- **Description** — what the weakness is
- **Evidence** — reproducible proof (requests, screenshots, steps), sanitised
- **Impact** — what an attacker could achieve
- **Likelihood** — how easily it could be exploited
- **Remediation** — specific, actionable fix
- **References** — CVE, CWE, vendor advisory, or standard

## 4. Risk summary table
| ID | Finding | Severity | Affected asset | Status |
|----|---------|----------|----------------|--------|
| 01 |         |          |                | Open   |

## 5. Remediation plan
- Prioritised list of fixes (by risk, then effort)
- Owners and suggested timelines
- Quick wins vs. longer-term hardening

## 6. Retest / validation
- Which findings were retested
- Outcome of retest (fixed / partially fixed / open)
- Residual risk after remediation

## 7. Appendices
- Tools used
- Full asset inventory tested
- Glossary of terms
- Severity rating scale used

---

*Tip: agree the report format with your testing firm before the engagement starts, so the
deliverable matches what your auditors, customers, or board actually need.*