Ethical Security Testing
Intermediate 16 min read Ethical Security Testing

Reporting and Remediation

The finding is only half the job: the report that executives, engineers, and lawyers each read sets the terms of the fix — and the fix verifies the report.

pentest reportremediationCVSSexecutive summaryverificationre-test
Prerequisites: Exploitation Fundamentals Risk Management
Introduction

What is this?

A penetration test report translates technical findings into three true stories — executive summary, technical detail, and remediation plan — verified by a re-test that proves the fix closed the gap.

Motivation

Why do you need it?

  • The report is the deliverable that drives budgets and fixes — a brilliant test buried in a bad report fixes nothing.
  • Auditors and boards read the executive pages; engineers read the technical appendix. Both must be honest.
  • Verifying the fix is what turns a report from 'findings' into 'outcomes' — the re-test closes the loop.
Think about it

Mental model

Imagine

A doctor's chart

Think of

The prescription and the follow-up visit

The chart names the disease, the prescription treats it, and the follow-up confirms it took.

Mechanics

How it works

  • Executive summary: business risk story in 2 pages — what was tested, top risks, recommended next steps.
  • Technical report: per-finding sections with reproducible steps, evidence, CVSS, remediation guidance.
  • Remediation planning: owners, due dates, and severity-ranked order agreed with the client.
  • Verification re-test: after fixes land, re-run the affected checks and close the finding with proof.

The find-fix-verify loop

Report
Plan
Fix
Verify
Close
Real world

In production

  • An exec summary's 'three things to do this quarter' gets a CFO's signature; the technical appendix feeds the engineers' sprint.
  • A client re-tests and sees their top CVSS drop from 9.8 to 3.1 — the report is now an audit artifact, not a scare.
  • A fix gets verified within 30 days by a quick scoped re-scan, closing the finding in the tracker.
Guidelines

Best practices

  • Write findings with reproducible steps and evidence artifacts; 'trust us' fails every audit.
  • Separate audiences: executive summary, technical detail, remediation appendix.
  • Rank by business impact, not CVSS alone; reachability and asset criticality factor in.
  • Always offer the verification pass; closing the loop is the professional finish.
Watch out

Common mistakes

  • A report with zero summaries for leadership — engineers nod, nobody funds the fix.
  • Findings without remediation guidance: the whole point is a change, not a verdict.
  • CVSS as the single sort key, producing a list out of step with the business's real exposure.
  • Never re-testing, so 'fixed' claims live in a changing estate forever.
When things break

Debugging tips

  • When a fix claim is unverifiable, re-run exactly the reproduction from the report; version drift fools everyone.
  • Keep the re-test scope identical to the original discovery scope for a fair comparison.
  • Store the report and re-test in the same tracker link; the timeline IS the evidence.
Security

Security considerations

  • A pentest report is highly sensitive — encrypt, limit distribution, and expire access.
  • Remediation must be verified in an environment the client authorizes; a verification scan out of scope is a new finding by itself.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

A pentest report's primary deliverables are...

2

The verification pass exists to...

Go deeper

Official documentation

PTES reporting guidance
docs
FIRST CVSS 3.1
docs