{"id":"CYB-11069","slug":"penetration-test-report-what-it-contains","title":"What a useful penetration test report contains, and how to act on it","excerpt":"What to expect in a penetration test report, from the executive summary to CVSS-ranked findings, evidence and fix steps, and how to turn the findings into fixes and a clean retest.","kind":"Guide","searchIntent":"informational","category":"cybersecurity","tags":["penetration test report","vulnerability management","CVSS","retesting","security testing"],"seoKeywords":["penetration test report","what is in a pen test report","penetration test findings","CVSS severity ranking","penetration test retest"],"authorId":"edilec-engineering","publishedAt":"2026-10-13","updatedAt":"2026-10-13","readingTime":"4 min","image":"/social-images/blog/edilec-photo-cyb-11069-d6e6a8b55890.jpg","status":"published","sourceCredits":[{"title":"Common Vulnerability Scoring System v4.0 Specification","url":"https://www.first.org/cvss/v4-0/specification-document","author":"FIRST"},{"title":"SP 800-115: Technical Guide to Information Security Testing and Assessment","url":"https://csrc.nist.gov/pubs/sp/800/115/final","author":"National Institute of Standards and Technology"},{"title":"OWASP Web Security Testing Guide","url":"https://owasp.org/www-project-web-security-testing-guide/","author":"OWASP Foundation"}],"body":[{"type":"paragraph","text":"The report is what you keep after a penetration test. A useful one tells leaders what the risk is in plain language, tells engineers exactly what to fix and how to check the fix, and gives you evidence you can show a customer, auditor or regulator. At Edilec, every report contains an executive summary, findings ranked by severity with CVSS, the evidence behind each finding and the steps to fix it, followed by retest results on the terms in your contract and a signed testing certificate."},{"type":"image","src":"/social-images/blog/edilec-photo-cyb-11069-d6e6a8b55890.jpg","alt":"A hand marking a printed, clipped report with a red pen beside an open laptop, with coloured flags along the pages.","caption":"A useful report turns each finding into an owner, a fix and a retest.","width":1200,"height":750},{"type":"heading","id":"executive-summary","depth":2,"text":"The executive summary"},{"type":"paragraph","text":"The summary is written for people who will not read the rest. It should answer four questions in a page: what was tested, what the most serious problems are, what they could lead to in business terms, and what to do first. It should not hide behind jargon or bury a serious issue in a long table."},{"type":"heading","id":"the-findings","depth":2,"text":"The findings"},{"type":"paragraph","text":"Each finding is a self-contained record. An engineer should be able to pick one up, reproduce it in the agreed test environment, fix it and know how to prove the fix worked, without reading the rest of the report."},{"type":"table","columns":["Part of a finding","What it tells you"],"rows":[["Title and affected component","Which system, URL, API or account the issue is in"],["Severity","A CVSS score and rating, adjusted for the impact in your environment and explained in plain words"],["Description","What the weakness is and why it matters to your business"],["Evidence","Requests, responses and screenshots from test accounts that show the issue is real, with sensitive data removed"],["Steps to reproduce","How your team can see the problem for themselves"],["Fix","The change that removes the cause, not only the symptom, plus any short-term mitigation"],["References","Relevant standards such as the OWASP testing guides"]]},{"type":"callout","tone":"tip","title":"Critical issues do not wait for the report","text":"If testers find a critical weakness during the engagement, your named contact hears about it immediately. The report records it later, with the fix and the retest result."},{"type":"heading","id":"severity-ranking","depth":2,"text":"How severity is ranked"},{"type":"paragraph","text":"The Common Vulnerability Scoring System (CVSS), maintained by FIRST, gives each finding a base score from how it can be exploited and what it affects. A base score alone can mislead, because the same weakness matters more on a payments API than on a brochure page. Good reports adjust for your environment, explain the reasoning in plain language and say which findings could be combined into something worse than any single one."},{"type":"table","columns":["Rating","What it usually means in practice"],"rows":[["Critical","Direct, likely path to serious harm, such as taking over accounts or moving money; fix immediately"],["High","Serious harm is possible with some effort or preconditions; fix before or soon after release"],["Medium","Real weakness with limited impact or harder exploitation; schedule the fix"],["Low","Hardening or hygiene improvement; fix with normal maintenance"]]},{"type":"heading","id":"turning-findings-into-fixes","depth":2,"text":"Turning findings into fixes"},{"type":"list","items":["Give every finding an owner and a target date, starting with critical and high.","Fix the cause. If a permission check is missing on one API, check the same pattern everywhere else.","Add a test that fails while the weakness exists, so it cannot quietly return.","Record any finding you decide to accept, with the reason and who accepted the risk.","Tell the testers when fixes are ready, so the retest checks the real fix."]},{"type":"heading","id":"retesting","depth":2,"text":"Retesting"},{"type":"paragraph","text":"A retest confirms which fixes work. At Edilec, retest terms are agreed in each contract. The retest report lists every original finding as resolved or still open, so you can show a clear before-and-after. Where a finding remains open, the report should say what is left and who owns it."},{"type":"heading","id":"sharing-the-report","depth":2,"text":"Sharing the report safely"},{"type":"paragraph","text":"Reports describe how to break your systems, so treat them as sensitive. Share the full report only with the people who fix things, keep the executive summary for wider audiences, and share Edilec's signed testing certificate, which confirms what was tested and when, if a customer, partner or auditor asks for proof. Test data held by Edilec is stored encrypted and deleted at the end of the period agreed in the contract."},{"type":"paragraph","text":"For how the work starts, see [How to scope a penetration test](/blog/cyb-11067/how-to-scope-a-penetration-test/). Edilec's approach is described on [Penetration Testing and Red Team Services](/services/penetration-testing/)."},{"type":"image","src":"/attachments/article-media/editorial/edilec-pentest-report-anatomy.svg","alt":"Six-part Edilec diagram of a penetration test report: executive summary, CVSS-ranked findings, evidence, fix steps, owners and dates, and retest results.","caption":"Each finding carries its severity, evidence and fix, and the retest shows which are resolved."}],"relatedArticleIds":["CYB-11067","CYB-11068","CYB-11070","KM-SEC-0218"],"faqs":["FAQ-SEC-PT-003","FAQ-SEC-PT-004","FAQ-SEC-PT-005","FAQ-SEC-PT-009"],"researchSources":[{"title":"Common Vulnerability Scoring System v4.0 Specification","url":"https://www.first.org/cvss/v4-0/specification-document","author":"FIRST"},{"title":"SP 800-115: Technical Guide to Information Security Testing and Assessment","url":"https://csrc.nist.gov/pubs/sp/800/115/final","author":"National Institute of Standards and Technology"},{"title":"OWASP Web Security Testing Guide","url":"https://owasp.org/www-project-web-security-testing-guide/","author":"OWASP Foundation"}],"mediaAssets":[],"relatedIds":["CYB-11067","CYB-11068","CYB-11070","KM-SEC-0218"]}