Reporting, communication and professional conduct
Reporting, communication and professional conduct
This domain tests whether the engagement produces value and stays ethical: a report a non-technical executive can act on, findings a engineer can reproduce, and conduct that protects the client and the tester.
Report structure
- Executive summary: business risk in plain language, the headline issues, and an overall verdict. No payloads, no jargon.
- Scope, objectives and constraints: what was tested, what was excluded, and the dates and limitations.
- Findings: title, risk rating (CVSS plus business context), description, affected assets, reproduction steps, evidence, remediation advice and references.
- Appendices: tool output, payloads and methodology detail, kept separate so the body stays readable.
- Retest statement: what will be re-tested, when, and on what basis a finding is closed.
Communication and conduct
- Escalate critical findings immediately through the agreed channel, for example an exposed credential or evidence of active compromise, rather than waiting for the report.
- Protect data: encrypt deliverables in transit, use agreed transfer channels, redact personal data and customer records, and destroy test data at the end.
- Stay honest: distinguish confirmed exploitation from theoretical risk, do not inflate severity to look thorough, and do not hide a finding that reflects badly on your own earlier work.
- Disclose conflicts of interest and never exceed authorised scope, even when a tempting path appears.
Worked example
During reconnaissance you find a live API key in a public repository belonging to one of the client's software vendors. Reasoning: the vendor's systems are out of scope, so you must not test them. Report the key to the client's named contact, redact it in the deliverable, and recommend the client notify the vendor through its own supplier channel. This handles a real risk without breaching scope or data protection obligations.
Traps that cost marks
- Burying a critical finding in an appendix.
- Ratings that ignore business context, or that contradict the technical description.
- Including unredacted personal data or live credentials in the report.
- Findings without reproduction steps, so the client cannot verify or fix them.
- No escalation of an active compromise because the report was not finished.