We received our pentest report but don't understand it — what does it mean, what should we look at?

Your sysadmin's "the system is working" defense is misleading. A web application being functional is completely different from it being secure. For example, if there is a SQL injection vulnerability, the system will keep taking orders flawlessly, but a malicious party can dump your entire customer and balance ledger with a single query via the URL. Definitely look at the proof-of-concept evidence in the report.

classic sysadmin reaction unfortunately they call it an exaggeration so they don't get stuck with extra work then what management should do is drop the rows labeled 'critical' and 'high' into an excel sheet set hard deadlines and make the responsible person sign off on it. anything else is just a waste of time.

edit: typed from phone, sorry for typos.

Call the cybersecurity firm that ran the test and, if it's covered in your contract, request a one-hour debrief meeting. Bring your IT admin to the call and ask the pentester point-blank: "Can this vulnerability be exploited to take down our B2B ordering site or steal customer data?" That will end the debate right then and there.

Sometimes security firms just dump raw outputs from automated vulnerability scanners and hand it over as a 40-page report. In that case, false positives can happen. That might be what your IT admin is pushing back on. Check the report to see if there is actual, manually verified proof of exploitation behind each finding.

The roadmap to turn the report into action: 1) Set an emergency 7-day patch schedule for critical findings. 2) Test the fixes in a staging environment instead of production to ensure the order flow doesn't break. 3) Use your contract's complimentary retest allowance to get the findings formally closed.

As someone who has managed audit processes for years, I can tell you this: The report is the diagnosis, the real responsibility is administering the cure. A one-person IT department can struggle to handle day-to-day operations while simultaneously patching complex web vulnerabilities. If needed, get support from the external agency that built the web software to help out your sysadmin.

do you have to pay the cybersecurity firm all over again from scratch for this verification test thing? i didn't see any clause about a retest in our proposal, is this service gnerally included in the price?

I agree with this. If 2FA is on, a stolen password alone is useless.

If you post the result here, it will help others too.

How did you solve this? Processes without records never improve, because you don't know what to fix.

If you don't write this down from the start, it leads to arguments later. Just leaving this note, it might be useful.

The answer above hits the nail on the head. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If you post the result here, it will help others too.

Three different views emerged, they all complement each other. Solutions that work at a small scale collapse when you grow; I learned this late.

Taking measures without an inventory leaves doors you haven't seen open. Of course, it varies if your situation is different.

You're right.

Absolutely. If I were to add anything: The biggest time-waster for us was not knowing who had the final say.

If you post the result here, it will help others too.

The cheap-looking path usually ends up costing more later. Most incidents start with a leaked password not a vulnerability.

Of course it varies if your situation is different.

I went through the same thing.

The discussion got scattered, let me summarize. Everyone rushing into what is a pentest report gets stuck at the same point.

Security isn't absolute; it's about making attacks not worth the effort. That's all, sorry if I went on too long.

You're right. If 2FA is on, a stolen password alone is useless.

If it's your first time, start small; scaling comes later. Hope this helps.

If you're going this route, sort this out first. Having backups accessible on the same network and with the same identity makes them part of the target.

If I were you, I'd go this route.