Executive summary or full report
Match the document to the reader, decision, confidentiality boundary, and required technical detail.
Read nextReport guide
What should a penetration-test report contain?
The report should include an executive summary, authorized scope, methodology and limitations, work performed, findings, supporting evidence, risk explanation, remediation direction, and retest status where applicable.
The report should let technical teams act on findings and let other readers understand the assessment boundary. It should not imply that untested systems were covered or that third-party acceptance is guaranteed.
Published by Trespass Security
Core sections
The report should answer these questions.
What was tested
- Executive summary and reason for testing
- Authorized systems, environments, roles, and exclusions
- Methods and work performed
- Important limitations or changes
What was found
- Finding descriptions and affected systems
- Evidence and reproduction steps where appropriate
- Risk and likely business impact
- Remediation guidance
- Retest status and remaining limitations
Executive summary
Summarize the results without overstating what was tested.
The summary should state why the test was performed, what it covered, the main findings, and the recommended next steps in plain language.
View the complete sample report (PDF). This is an illustrative sample, not a client engagement record.
It should not make a blanket claim that the organization, application, or environment is “secure.”
Technical detail
Each conclusion should be tied to the systems and work behind it.
The report should connect its conclusions to the assets, access, actions, observations, and limitations involved in the test.
- Authorized scope
Name the assets, environments, roles, and boundaries included in the work.
- Methods and work performed
Describe what was actually done, not only the standards used.
- Limitations
Record unavailable access, exclusions, environmental differences, time constraints, and other limits.
- Finding evidence
Provide enough detail for the client to understand and fix the issue without exposing unnecessary sensitive information.
- Retest status
Separate the original findings from the results observed after remediation.
Sharing with customers
Can you share the penetration-test report?
Possibly, but sharing should follow the engagement terms, confidentiality obligations, sensitivity of technical detail, and the recipient’s stated requirement.
- Confirm whether the recipient needs the full report, an executive summary, scope and completion evidence, or answers to specific questions.
- Review NDA, restricted-access, trust-center, or secure-delivery expectations.
- Consider whether the full report exposes technical detail that should be limited to a smaller audience.
- Keep limitations and retest status attached to any shared conclusions.
- Plan for customer follow-up rather than assuming document delivery ends the review.
What the recipient needs
Ask what they expect to receive before the test is scoped.
Their answer may affect the scope, report format, level of executive detail, confidentiality controls, and whether fixes need to be retested before the report is shared.
The recipient makes the final decision: confirm what they expect to receive before the test is scoped.
Next step
Tell us what evidence the requester expects.
Send the original wording, intended recipient, likely systems, and deadline. Trespass will make report and scope questions part of the engagement definition.