A pen testing report includes the executive summary, the scope and methodology, a risk statement, and technical finding details. Each of these sections are meant to work separately and be useful to different audiences.
What is a penetration test report?
A pen test report is what is typically delivered at the end of a pen testing engagement. This is the details of everything that was done, how it was done, and any findings that were discovered.
Often these are between 50-100 pages, so they are broken into sections to be easily read. In addition, the findings section will be ordered by priority to make it easier to work on the most important issues.
What is the structure of a pen test report?
A pen test report is structured often to give a summary first, then begin diving into the details.
This allows for an easy and quick read for those not interested in the specifics of the findings, like executives. An executive summary is aimed at being clear and concise with the findings, scope, and methodology without being too technical.
It should have a lot of graphs and charts to make the information easy to digest, understand, and compare. If multiple tests are being done, this can also compare the previous results to the current ones.
The next portion is more technical but doesn’t address the findings yet, as they are often kept as an addendum or even a separate document due to their sensitive nature.
It should cover scope, methodology, the tester’s bios, the time frame, any general recommendations and takeaways for future tests, and an understanding of the results.
A risk assessment or security posture statement could function as this understanding, so an auditor or similar can see how the organization fares as a whole based on these results, especially compared to industry standards.
Finally, the findings of the penetration test are addressed.
These will have specific details on what was found, how it was discovered, and what to do about it.
These will come with a severity and risk rating to better understand the priority of what to fix first. It should contain enough details for the internal team to understand and fix the findings.
List of items that are to be expected in a pen test report:
- Executive summary: this is a non-technical description of the test and it’s findings
- Methodology: how was the test conducted
- Scope: A very important component highlighting what was tested
- Technical details/Findings/Results: this may occur under multiple names but it is the details of what was discovered, how they were found, and what to do about them. This is aimed at technical resources to understand the findings.
