What you receive at the end of an engagement
A report is only valuable if people act on it. Ours is written for two readers at once: leadership who need the risk in plain language, and engineers who need exact steps to fix it.
Confidential · Sample
Penetration Test Report
| Ref | Finding | CVSS |
|---|---|---|
| EL-01 | Insecure direct object reference, statements API · Critical | 9.3 |
| EL-02 | OTP verification lacks rate limiting · High | 8.1 |
| EL-03 | Session not invalidated on logout · High | 7.4 |
| EL-04 | Missing Content Security Policy · Medium | 5.3 |
Six sections, in this order
-
01
Executive summary
Two pages for leadership: overall risk rating, the issues that matter most and what they mean for the business.
-
02
Scope and method
Exactly what was tested, when, from where and against which standards, so auditors can rely on the work.
-
03
Risk dashboard
Findings by severity and category, compared against previous tests where they exist.
-
04
Technical findings
Each finding with affected assets, reproduction steps, evidence, CVSS v4 score and business impact.
-
05
Remediation guidance
Specific fixes for your technology stack, with quick wins marked and references for each.
-
06
Retest and attestation
The status of every finding after remediation, and a letter you can share with regulators, partners and customers.
Want the full redacted sample? Request it and we will send it after a short call.
Request the full sample