Answer

What does a penetration test report contain?

Short answer

A penetration test report contains an executive summary, the scope and methodology used, a findings section with evidence, reproduction steps and severity ratings, specific remediation guidance for each issue, and a retest record confirming which findings were closed. Anything without reproduction steps and a named methodology is a scanner export.

The executive summary is written for someone who will never read a request header. It should state what was tested, what the most serious realistic outcome was, and whether the overall posture improved or worsened since the last test — in plain language, in under a page.

Each finding needs six things: a title, a severity with the scoring rationale, the affected component, evidence, exact reproduction steps, and a fix specific enough to implement. "Implement proper access control" is not remediation guidance; "add the ownership check in OrderPolicy::view and cover it with the test case below" is.

Two sections are frequently missing and worth demanding: a coverage statement saying what was in scope and what was deliberately not tested, and a retest record. Without the first, a clean report is meaningless; without the second, you have no evidence the issues were ever fixed.

Report sections and who reads them

Report sections and who reads them
SectionAudienceWhy it matters
Executive summaryFounders, board, customersThe version that gets forwarded
Scope and methodologyAuditors, buyersProves what was and was not covered
Findings with evidenceEngineersThe work list
Severity and risk ratingProduct ownersPrioritisation
Remediation guidanceEngineersTurns findings into commits
Retest recordAuditors, customersEvidence issues were closed

In short

  • Ask for a sample report before signing anything.
  • CVSS scores should include the vector string and the reasoning.
  • An attestation letter is the artefact your customers actually want.
  • Reports should be handed over with a walkthrough call, not emailed cold.

Sources

Want this tested properly?

Scope and a fixed quote within two working days. First consultation is free.