Report Generation Technique

Goal: produce professional penetration test reports that meet industry standards and satisfy both technical and executive audiences.

When this technique applies

• Need to compile pentest findings into a structured report.
• Writing executive summaries or detailed technical findings.
• Creating attack narratives or remediation guidance.

Initial triage

Before writing, classify the deliverable and the evidence maturity so the report structure matches the engagement outcome.

• Starting state: are you producing an executive summary, a full technical report, an interim findings memo, or a single-finding writeup?
• First questions: who is the audience, what evidence is already validated, what findings are report-ready, and what methodology/scope context must be stated up front?
• Immediate actions: sort findings by severity and confidence, identify missing proof or remediation details, and build the report skeleton before prose.
• Tool-family direction: this technique mostly coordinates evidence and structure; pull from the relevant technique/tool outputs rather than inventing new tooling here.
• Escalation rule: do not polish narrative before confirming evidence quality, scope statements, and remediation ownership.