Reporting
Reporting & Documentation
A professional penetration test report communicates findings, demonstrates risk, and provides actionable remediation guidance. Documentation throughout the engagement ensures comprehensive and accurate reporting.
Tip
Start documenting from day one. Collecting evidence and notes during testing is far easier
than trying to reconstruct steps after the fact.
flowchart TD
A[Reporting] --> B[Evidence Collection]
A --> C[Finding Templates]
A --> D[Executive Reports]
A --> E[Technical Reports]
B --> B1[Screenshots / Logs / Notes]
C --> C1[CVSS Scoring / Templates]
D --> D1[Business Language / Risk]
E --> E1[Attack Chains / Remediation]
style A fill:#22c55e,stroke:#000,color:#000
style B fill:#10b981,stroke:#000,color:#000
style C fill:#10b981,stroke:#000,color:#000
style D fill:#10b981,stroke:#000,color:#000
style E fill:#10b981,stroke:#000,color:#000
Reporting Components
📸
Evidence Collection
Screenshot tools, terminal logging, note-taking workflows, and evidence organization systems.
Screenshots Logging Obsidian tmux
📋
Finding Templates & CVSS
Standardized finding documentation, CVSS 3.1 scoring guide, and severity rating consistency.
CVSS 3.1 Templates Severity CWE
👔
Executive Reports
Writing effective executive summaries using business language and risk quantification.
Executive Summary Business Impact Risk $$$ Priorities
"
🔧
Technical Reports
Detailed attack chains, step-by-step reproduction, remediation guidance, and appendices.
Attack Chains Reproduction Remediation Appendices
Report Structure Overview
| Section | Audience | Focus | Length |
|---|---|---|---|
| Executive Summary | C-Suite, Management | Business risk, priorities, costs | 1-2 pages |
| Findings Summary | Security Leaders | All findings by severity | 2-5 pages |
| Technical Details | Security Engineers | Reproduction, attack chains | 10-50+ pages |
| Remediation | IT/DevOps Teams | Fix steps, validation | Per finding |
| Appendices | Deep Dives | Raw data, tool output | As needed |
Severity Ratings Quick Reference
Critical
CVSS 9.0-10.0
Immediate action
High
CVSS 7.0-8.9
1-2 weeks
Medium
CVSS 4.0-6.9
1-3 months
Low
CVSS 0.1-3.9
3-6 months
Info
CVSS 0.0
Best practice
Quick Reference
Documentation Tools
- • Obsidian / Notion
- • Flameshot / ShareX
- • tmux logging
Key Standards
- • CVSS 3.1
- • MITRE ATT&CK
- • CWE/OWASP
Report Components
- • Executive Summary
- • Technical Details
- • Remediation Plan