Pentest and audit

What a pentest report must contain

If only the pentester understands the report, it does not work. A checklist for judging any report.

3 min read

The report is the main product of a pentest. The director, the developers and the auditor make decisions based on it, so it must speak to each of them.

For the executive

A one-page summary: what was tested, what was found, the overall risk level.
Three to five main problems with business impact, not technical names.
What to do first and roughly how long it takes.

For developers

Every finding: where, how to reproduce step by step, evidence (screenshot, request, response).
CVSS risk level and an explanation of why exactly that.
A concrete fix recommendation, not "follow best practices".

For the auditor

Methodology and scope.
Dates, team, access mode.
Confirmation of the retest after the fixes.

Articles

Pentest and audit

What a pentest is and how it differs from a vulnerability scanner

A scanner finds known holes from a list. A pentester thinks like an attacker and chains small things into a real breach.

4 min read

Pentest and audit

Types of pentest: web, API, mobile apps, infrastructure, cloud, people

Each type checks its own layer. Together they give the picture, separately only a fragment.

5 min read