Pentest Reporting (REPORT phase — the end that makes the work count)

Overview

A vulnerability nobody fixes isn't security. This phase converts raw findings into a report that engineers can act on and leaders can prioritize: consistent severity, crisp reproduction, honest impact, concrete fixes, and tracked closure.

Core principle: Write for two readers at once — an executive who needs risk and priority, and an engineer who needs exact steps to reproduce and fix.

Structure of a good report

1. Executive summary — plain-language risk posture, top 3–5 risks, overall verdict. No jargon.
2. Scope & methodology — what was tested, environment, dates, what was out of scope.
3. Findings — one entry each (see template), ordered by severity.
4. Remediation roadmap — prioritized fix list with effort estimates.
5. Retest results — status per finding after fixes (Open / Fixed / Risk-accepted).
6. Appendix — tools, raw evidence, references.