Pen Test Report Quality Checklist

Use this on the sample report a firm sends with its quote, and again on the report you receive. A good report lets a director decide what to do and lets an engineer reproduce and fix every finding.

Executive summary

Says in plain language what was tested, when, and the overall result
Names the most serious risks and what they would mean for the business
Says what to do first
Can be read without the technical sections

Scope and method

Lists every system tested, and anything agreed in scope that was not tested, with the reason
States the testing dates, the perspective (outside or logged in) and the accounts used
Names the standards or methodology followed
Names the testers or their roles

Each finding

A clear title and the affected systems, URLs or hosts
A severity rating, with the rating method and version stated, such as a CVSS vector
A description of the weakness in plain terms
Evidence you can follow to reproduce it: requests, steps or screenshots
The impact: what an attacker could actually do
Specific remediation for your systems, not generic advice
References where useful, such as a CVE or CWE

After the findings

A summary table of all findings with their severity and status
A remediation plan ordered by risk
Retest results showing which findings are closed
Good practice the testers found, as well as the problems

Warning signs

Pages of scanner output with little explanation.
Findings with no evidence, or evidence you cannot follow.
Severity ratings with no method behind them.
The same generic remediation text on many findings.
No statement of what was in scope or when it was tested.
Nothing on business impact.

Find firms that fit your scope

Answer a few questions and see the firms that match what you need tested and the accreditation you need.

Find a firm

Penetration test report quality checklist