Penetration Testing

Penetration Test Report Explained: How to Read and Act on Your Results

> report_status: delivered —— findings: documented —— next_step: understand_and_act<span class="cursor-blink">_</span>_

Hedgehog Security 13 August 2024 11 min read

Now what do you do with it?

You commissioned a penetration test, the tester has finished their work, and a report has landed in your inbox. For many business owners and IT managers, this is where uncertainty sets in. The report may be thirty, fifty, or a hundred pages long. It contains technical language, risk ratings, evidence screenshots, and remediation recommendations. How do you read it? What matters most? And how do you turn it into action?

This article breaks down the anatomy of a penetration test report, explains how to interpret each section, and provides a practical framework for acting on the results.


Recommended

We found this during a real engagement.

Want to know if your environment has the same weakness? Book a free 30-minute scoping call.

Book a Scoping Call

What each section is for.

Section Written For What to Look For
Executive Summary Business owners, directors, board members — anyone who needs the headline without the technical detail. Overall risk assessment. The three to five most significant findings explained in business terms. Strategic recommendations. This section should be comprehensible without any technical background.
Scope and Methodology All readers — provides context for interpreting the findings. Confirmation of what was tested, what was excluded, what approach was used, and the dates of the engagement. Important for compliance evidence and for understanding the boundaries of the assessment.
Findings Summary All readers — quick overview of volume and severity. A table or chart showing findings by severity level. Gives you an immediate sense of scale — how many critical, high, medium, and low issues were found.
Detailed Findings IT team, developers, system administrators — the people who will fix the issues. Each finding with: description, location, evidence of exploitation, risk rating with justification, and specific remediation steps. This is the longest section and the one your technical team will reference during remediation.
Appendices Technical specialists working on specific issues. Raw tool output, complete scan data, and detailed evidence chains. Reference material — most readers will not need to review this section in detail.

What critical, high, medium, and low mean in practice.

Risk ratings translate technical vulnerabilities into business language. They combine two factors: the likelihood of exploitation (how easy is it for an attacker to use this vulnerability?) and the impact of exploitation (what is the consequence if they do?). Understanding these ratings is essential for effective prioritisation.

Risk Rating Framework
── Critical ────────────────────────────────────────────────
Likelihood: High — trivially exploitable, often remotely
Impact: Severe — full system compromise, data breach
Action: Fix within 24–48 hours
Example: Default admin credentials on public-facing system

── High ────────────────────────────────────────────────────
Likelihood: Moderate to high — exploitable with some effort
Impact: Significant — privilege escalation, data access
Action: Fix within 1–2 weeks
Example: SQL injection in authenticated application

── Medium ──────────────────────────────────────────────────
Likelihood: Moderate — requires conditions or chaining
Impact: Moderate — information disclosure, limited access
Action: Fix within 1–3 months
Example: Missing security headers, verbose error messages

── Low / Informational ─────────────────────────────────────
Likelihood: Low — difficult to exploit or requires insider
Impact: Minor — best-practice improvements, hygiene
Action: Fix during routine maintenance
Example: Server software version disclosure

The most important two pages.

If you are a business owner, the executive summary is the section written for you. It should answer four questions without requiring any technical knowledge: what was tested, what is our overall risk level, what are the most serious issues, and what do we need to do? If your executive summary does not answer these questions clearly, ask your provider to revise it — this section exists to inform business decisions.

The Debrief Meeting

Do not just read the report — schedule a debrief meeting with your provider. A good debrief includes the tester walking you through the findings, explaining the significance of each one in your specific business context, and answering questions from both your business and technical stakeholders. This is where the real value of the report is unlocked.


From findings to fixes.

A report that sits in a drawer is worthless. The value of a penetration test is realised only through remediation — fixing the vulnerabilities that were found. The report gives you everything you need to act: the vulnerability, its location, the evidence, and the fix.

Step Action
1. Triage Sort findings by severity. Critical and high findings are your immediate priority. Medium findings are your short-term plan. Low findings go into your maintenance backlog.
2. Assign ownership Every finding needs a named owner — the individual responsible for resolving it. Findings without owners do not get fixed.
3. Set deadlines Assign realistic target dates for each finding based on its severity and the effort required. Track progress weekly for critical and high findings.
4. Fix and verify Implement the recommended remediation. Then verify — either through internal testing or by requesting a retest from your penetration testing provider.
5. Document accepted risks For any finding you choose not to fix, document the reason, who approved the decision, and any compensating controls. This is essential for compliance and audit purposes.

What separates a good report from a poor one.

Not all penetration test reports are created equal. A good report enables action. A poor report creates confusion. If your report consists primarily of automated scanner output with generic remediation advice, you have received a vulnerability scan report — not a penetration test report.

Good Report Poor Report
Executive summary written in plain business language No executive summary, or one filled with technical jargon
Evidence of manual testing — exploitation screenshots, custom payloads, step-by-step attack narratives Dominated by automated scanner output (Nessus, Qualys) with no evidence of manual work
Risk ratings explained with business context — 'an attacker could access 50,000 customer records' Risk ratings based solely on CVSS scores with no business context
Specific, actionable remediation guidance tailored to your environment Generic remediation copied from vulnerability databases
Attack chains documented — showing how multiple vulnerabilities combine to create greater impact Each finding presented in isolation with no discussion of combined risk

Our reports are written for your whole organisation.

Every report we deliver includes a clear executive summary, detailed evidence of manual testing, business-context risk ratings, and specific remediation guidance. We also include a debrief session where we walk your team through every finding and answer your questions.

Next Step

We found this during a real engagement.

Want to know if your environment has the same weakness? Book a free 30-minute scoping call.

Book a Scoping Call

Related Articles