How to Write a Penetration Testing Report Clients Can Act On

The report is the product of a penetration test. The client cannot see your skill during testing; they see the document afterward. A strong report gets findings fixed. A weak one gets filed and forgotten. Here is a structure and the habits that make a report useful.

Know Your Two Readers

Managers want to know how much risk there is, what matters most and what it will take to fix. Engineers want exact steps to reproduce each finding and a clear fix. A good report serves both, in separate sections.

A Standard Structure

• Executive summary: one or two pages in plain language: overall risk, the most serious issues, and priorities
• Scope and method: what was tested, when, from where, what was out of scope, and the approach
• Findings summary: a table of all findings with severity
• Detailed findings: one section per finding
• Appendices: tools used, raw output where useful, and retest results

How to Write Each Finding

• Title: the flaw and where it is, for example "Any user can view other customers' invoices (/api/invoices/{id})"
• Severity, with a score such as CVSS v4 and a short justification
• Description: what is wrong, in plain words
• Impact: what an attacker could do, in business terms
• Steps to reproduce: numbered, exact, with requests and responses
• Evidence: screenshots with sensitive data masked
• Recommendation: the specific fix, not just "follow best practice"
• References: OWASP, vendor advisories, CWE entries

Show the Attack Path

In network and Active Directory tests, the most valuable part is often the chain: weak password, then excess permission, then domain admin. A simple diagram of the path, with the one or two fixes that break it, is worth more than twenty separate low findings. See Active Directory attacks explained.

Mistakes Reviewers Flag

• Pasting raw scanner output as findings
• Severity inflated to make the report look impressive
• Steps a developer cannot follow
• Unmasked passwords or personal data in screenshots
• Generic recommendations copied between findings
• No retest section, so nobody knows what is fixed

Handle the Report as Confidential

A penetration test report is a map of how to attack the client. Share it only through agreed, secure channels, never paste client details into public AI services, and delete working data as the contract requires.

See an Example

Our sample graded penetration test report shows the format our students submit. Every course in our program ends with a report like it, reviewed by an instructor: see network and Active Directory testing and application security.