Penetration Testing Reporting and Communication
Penetration Testing Reporting and Communication
This domain tests whether you can turn technical evidence into decisions. A report must be accurate, reproducible, risk-ranked in context, and readable by both executives and engineers. Communication during the engagement matters as much as the final document.
Core rules
- Standard structure: executive summary, scope and objectives, methodology, findings, risk ratings, evidence, remediation guidance, and appendices. The executive summary states business risk and priorities without jargon.
- Rate risk twice: a technical score such as CVSS and a contextual rating that considers asset criticality, exposure, data sensitivity, and existing controls. Explain any divergence.
- Each finding needs a clear title, affected asset, description, reproduction steps, evidence, impact, likelihood, and specific remediation. 'Patch it' is not remediation guidance.
- Escalate critical findings immediately through the agreed channel, especially evidence of active compromise or sensitive data exposure. Do not wait for the final report.
- Quality assurance: peer review for factual accuracy, consistent ratings, redaction of credentials and personal data, and secure delivery. Agree retention and destruction.
- Retesting verifies fixes and closes the loop; report retest results separately from the original findings.
Worked example
A SQL injection is found in an internal admin portal. CVSS scores it 9.8, but the portal is reachable only from a management VLAN, requires MFA, and stores no customer data. You report the CVSS score and a contextual rating of High rather than Critical, explaining the compensating controls and the residual risk if the VLAN is breached. Reasoning: the technical severity is real, but the business decision depends on exposure and data. Inflating the rating damages credibility; deflating it hides real risk.
Traps
Pasting scanner output; inconsistent ratings across similar findings; missing reproduction steps; failing to redact secrets; no retest; and communicating only at the end.