Risk & policies

What is a penetration test report?

A penetration test report is the deliverable from a pen test: it documents the scope and methodology, lists the vulnerabilities found with a severity rating and evidence for each, gives remediation guidance, and often records a retest confirming fixes. Buyers and auditors ask for it as proof you actively test your security, not just scan.

What the report contains

A pen test report typically includes an executive summary, the scope and rules of engagement, the methodology used, and a findings section that lists each vulnerability with a severity rating (often critical, high, medium, low), evidence or steps to reproduce, and remediation guidance. Many reports also include a retest section confirming which findings were fixed.

A pen test is not a vulnerability scan

A vulnerability scan is automated and lists known weaknesses; a penetration test adds skilled humans who chain issues together to see what an attacker could actually achieve. The report reflects that: it is about demonstrated impact, not just a list of scanner output.

How it is used

Buyers and auditors ask for a recent pen test report (or a summary/attestation letter, since the full report is sensitive) as evidence you test your defenses. Frameworks like SOC 2 and ISO 27001 expect regular testing, and the report plus your remediation is the proof.

FAQ