What a penetration test report contains
Short answer
A penetration test report records what was tested, what was found, how bad it is and how to fix it. The standard sections are an executive summary, scope and rules of engagement, methodology, a findings summary, a detailed write-up of each finding with reproduction steps and remediation, and retest results. Severity is usually a CVSS score.
The template above produces that structure. If you want to see a finished one first, read the full report from our OWASP Juice Shop engagement: 67 findings, each with the request and response that proves it.
What to write in each section
Document control
Client, testing company, authors, version, report date, test window, approach (black, gray or white box) and classification. An auditor checks the test window against the date the change they are auditing went live, so put exact dates.
Executive summary
Two or three short paragraphs for someone who will not read the rest: what was tested, the most serious risk in business terms, and the one or two fixes that remove most of it. "Anyone can read every customer's orders" gets a fix funded. "IDOR on /api/v2/baskets" does not.
Scope and rules of engagement
List every host, URL, IP range, application and test account in scope, and state what was excluded. The rules of engagement record the test window, source IP addresses, techniques that were not allowed (denial of service, social engineering) and when testers had to stop and call. This section is the evidence that the test was authorised.
Methodology and limitations
Name the standards followed, such as the OWASP Web Security Testing Guide or NIST SP 800-115, and say in a few sentences how the test ran. Then list what you could not test and why. Our Juice Shop report listed the parts it could not reach, including the login rate limiter's keying and the external OAuth flow.
Findings
Open with a table of every finding, sorted by severity, with its status. Then give each finding its own write-up: title, severity and CVSS vector, affected assets, description, impact, numbered steps to reproduce, evidence and a specific fix. Another tester should be able to follow the steps and see the same result.
Retest results
After the client fixes the issues, record the retest date and outcome for each finding: fixed, partially fixed or risk accepted. Compliance reviewers often want this evidence as much as the original findings.
Rating severity with CVSS
The Common Vulnerability Scoring System (CVSS), maintained by FIRST, turns eight properties of a vulnerability into a 0 to 10 base score. The template computes it with the CVSS v3.1 specification's equations, including its rounding rule, and maps it to the specification's rating scale:
Scroll for more columns →
| Rating | CVSS base score |
|---|---|
| Critical | 9.0–10.0 |
| High | 7.0–8.9 |
| Medium | 4.0–6.9 |
| Low | 0.1–3.9 |
| None (Informational) | 0.0 |
The base score describes the vulnerability, not your business. Exposure, the data at risk and compensating controls decide what to fix first, so say so in the impact section when the score overstates or understates the risk. CVSS 4.0 uses the same bands. Paste a 4.0 vector into a finding and the template keeps it as written; pick the severity yourself.
An example finding, written up
This is the first finding in the template's example. It is based on the forged admin tokens our Juice Shop engagement found, rewritten for a fictional app.
F-01 · Critical · CVSS 9.1
Server accepts unsigned JWTs (alg=none), allowing admin token forgery
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Affected
- https://api.example.com/v2 (all authenticated endpoints)
- Description
- The API accepts JSON Web Tokens whose header sets "alg": "none" and whose signature is empty. The server reads the claims without verifying a signature, so a client can choose any user ID and role.
- Impact
- An unauthenticated attacker can act as any user, including administrators, and read or change every customer record.
- Reproduce
- Log in as a customer and copy the session JWT.
- Decode it, set the header to {"alg":"none","typ":"JWT"} and the role claim to "admin".
- Re-encode it with an empty signature and send GET /api/v2/users with it.
- The server returns 200 and every user record.
- Fix
- Verify every token's signature with a fixed allow-list of algorithms (for example RS256 only) and reject alg=none. Rotate signing keys after the fix.
Mistakes that make a report hard to act on
- Pasting scanner output as findings. A scanner reports what might be wrong. A finding shows that it is, with the request and response.
- Steps that only the original tester can follow. "Intercept the request and change the ID" leaves out which request, which ID and what came back.
- Severity with no reasoning. Two testers can score the same bug differently. Our two Juice Shop runs disagreed on the severity of five bugs both found, and we settled each one by checking the evidence. Write down why you chose the rating.
- Remediation that says "validate input". Name the check, where it goes, and how to confirm it worked.
- No list of what was not tested. Without it, a reader assumes everything in scope was covered.
Frequently asked questions
What should a penetration test report include?
An executive summary, the scope and rules of engagement, the methodology and its limitations, a findings summary table, and a detailed write-up of each finding with severity, affected assets, reproduction steps, evidence and remediation. Add retest results once fixes are checked. The template above has all of these sections.
How is the severity of a pentest finding rated?
Most reports use CVSS. The template computes a CVSS v3.1 base score from the vector you enter. It maps the score to FIRST's scale: Critical 9.0 to 10.0, High 7.0 to 8.9, Medium 4.0 to 6.9, Low 0.1 to 3.9, and None (Informational) at 0.0. CVSS 4.0 vectors are kept as written, and you choose the severity.
Who reads a penetration test report?
Three groups. Leadership reads the executive summary to decide what to fund. Engineers read each finding to reproduce and fix it. Auditors and customers read the scope, methodology and retest results as evidence for SOC 2, ISO 27001 or a security questionnaire.
Is my report uploaded anywhere?
No. The template runs in your browser. Drafts are saved to your browser's local storage so they survive a reload, and the Markdown, HTML and PDF files are generated on your device.
Should I use CVSS v3.1 or CVSS 4.0?
Use whichever your client or auditor asks for. CVSS 4.0 was published by FIRST in November 2023 and keeps the same severity bands, but many scanners, ticketing systems and compliance templates still expect v3.1 scores.
Can someone write this report for me?
Helix Cyber runs the test and delivers the report: black box $3,000, gray box $4,000, white box from $7,000, with free retests. Every finding is reproduced by a second agent before it is written up.