00000
← Blog

Writing pentest reports people actually read

2 min read

Sample post. This is example content so you can see the layout. Edit or delete it in src/content/blog/, or publish your own posts from /admin.

The hardest part of a penetration test isn’t getting in. It’s getting the organisation to fix what you found after you leave. That happens in the report, and most reports are written to be filed, not read.

Here’s the structure I use.

1. An executive summary a non-technical reader can act on

One page. No jargon. It answers three questions:

  • What’s the real risk? Not “XSS was found” but “a customer’s session could be hijacked from a link in an email.”
  • How bad, in business terms? Data exposed, accounts affected, money or trust at stake.
  • What are the top three things to do first?

If a director reads only this page, they should still make the right call on funding the fix.

2. Findings written as a story, not a scanner dump

Each finding gets the same shape:

  1. What it is — one sentence.
  2. Where — the exact endpoint, parameter, or host.
  3. Why it matters here — tied to this business, not a generic CVSS blurb.
  4. How to reproduce — enough for their engineer to confirm it in five minutes.
  5. How to fix it — concrete, with a code or config example where possible.

3. Severity that reflects context

A reflected XSS on a marketing microsite and the same bug on the banking login page are not the same severity, whatever the base score says. I rate on realistic impact to the client, and I explain the reasoning so they can push back if they know something I don’t.

4. A remediation table they can turn into tickets

ID     Severity   Finding                         Owner        Fix-by
F-01   Critical   Auth bypass on /admin           Platform     7 days
F-02   High       Stored XSS in profile bio       Web          14 days
F-03   Medium     Missing security headers        Web          30 days

Copy-paste straight into Jira. The easier you make the next step, the more findings get fixed.

The mindset

A vulnerability you found but couldn’t get fixed is a vulnerability you left behind.

Write for the person who has to do something about it. That’s the whole job.