How many days should a penetration test report take — what should I see in a sample report?

Look closely at the 'PoC' (Proof of Concept) section in the sample report. In a real pentest, once the specialist finds a vulnerability, they must prove they can exfiltrate unauthorized data or execute commands using screenshots. Don't waste your time with firms that don't bother clearing false positives generated by automated scanners.

Make sure to get these clauses written into the service agreement: 1) An interim email notification will be sent within 24 hours whenever critical or high-severity findings are discovered, 2) The draft report will be delivered within 5 business days at most after testing concludes, 3) A one-time free verification test (re-test) will be conducted within 30 days after findings are remediated.

Our mobile and API tests wrapped up last month. Fieldwork finished on a Friday evening, and we had the draft report by Tuesday morning. There were 4 critical flaws; our dev team resolved them in 10 days, and the firm ran the re-test the next day and delivered a clean final report. Waiting 15 business days just for a report freezes your entire patching timeline.

Tell the firm asking for 15 business days that you require 'daily interim reporting for critical findings'. If they push back, drop them immediately. If vulnerabilities like database injection or remote code execution turn up during a pentest waiting two weeks without fixing them is commercial suicide.

Some vendors promising reports in 3 days aren't actually writing anything as they test; they just hit 'Export to PDF' on an automated scanner and slap your logo on the cover. Just as much as the turnaround time check the sample report to confirm it's hand-written and contains custom analysis tailored to your setup.

dont even sit down with a firm that wont share a sample report imo. you cant sign a deal without knowing what youre gonna get. legit firms always keep redacted samples ready with client permission anyway.

Pay close attention to the 're-test' window in the agreement. It'll take time to patch vulnerabilities once the report arrives. Getting a commitment from the firm to re-audit systems for free within at least 30 or 45 days of report delivery is vital for the health of the project.

if testing takes 5 days but the report takes 15, the engineer who ran the test is probably busy breaching another client's server instead of writing your report but if you have a critical bug web bots will discover it long before you find out two weeks later.

Absolutely. If I were to add anything: The biggest time-waster for us was not knowing who had the final say.

Solutions that work at a small scale collapse when you grow; I learned this late. Just leaving this note, it might be useful.

Sorry, but this doesn't apply in every case. Having backups accessible on the same network and with the same identity makes them part of the target.

I have an objection here. When making a decision, first look at what data you have on hand.

When making a decision, first look at what data you have on hand. I'm also curious if anyone does it differently.

Noted, thanks.

Timely topic. The harder it is to reverse a decision, the slower you should make it.

If you have questions, write them; I'll answer as best I can.

I have a question. People defend habits, not processes. Resistance comes from there.

This is my opinion, I'm not claiming it's absolute truth.

you're right. the hader it is to reverse a decision the slower you should make it.

i have a question. if the notification path is long notifications don't arrive; missing notifications mean delayed incident detection.

don't rely on a singe measure; go layer by layer. if you have questions, write them; I'll answer as best I can.

Thanks a lot, I'll try it today. If you don't write this down from the start, it leads to arguments later.

An automated scan report is not the same as a penetration test. Good luck with that.

Great work.