I've been tasked with writing a pentest report — what should it include, and what format works best?

Keep in mind that executives never read the technical sections. Write the first two pages specifically for the VP; for example, instead of saying "SQL injection was identified," writing "There is an active risk of customer data leaking from the order database" conveys the severity much better.

Don't guess risk levels out of thin air; base them on CVSS scoring logic. Whether a vulnerability can be exploited remotely or requires privileges directly changes the score. Also, remember to mask sensitive data and session tokens in your screenshots.

Stick to this structure when building your report outline: 1) Executive summary and overall risk rating, 2) Scope boundaries and test dates, 3) Vulnerability list with detailed proof-of-concept steps, 4) Prioritized remediation roadmap, 5) Retesting procedure overview.

Did your contract specify any particular report template? Some corporate clients require templates aligned with specific public sector or financial compliance frameworks; did you double-check upfront to avoid having to revise it later?

on my first report, I literally just translated a hundred-page vulnerability scanner exxport and sent it over and the client was furious. btw only report verified, actively exploitable vulnerabilities don't overwhelm them with noise.

Having your in-house team test and audit software they built themselves can trigger trust issues on the client's side. Be extremely transparent with your methodology so their internal IT team doesn't think you covered up your own team's mistakes.

We deliver about ten of these reports a year. Reports over forty pages rarely get acted on by dev teams. Keeping it between fifteen and twenty pages, concise and action-oriented, always yields much better results.

if u also drop a quick estimate of the dev effort needed next to each finding the client's dev team will adopt it way faster good luck.

Yes, that's exactly how it is with writing a pentest report. If 2FA is on, a stolen password alone is useless.

I'm also curious if anyone does it differently.

great work.

I felt relieved reading this answer, so it's not just me. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Most time waste accumulates in tasks waiting for approval. Proven by experience.

Absolutely. If I were to add anything: Start with a small trial; dont commit to everything at once.

Just leaving this note it might be useful.

if youre going this route sort this out first. btw if 2FA is on, a stolen password alnoe is useless.

just leaving this note it might be useful.

Just a heads-up. Forgotten test environments are more often the entry point than live systems.

If I were you, I'd go this route.

I'd appreciate it if you shared the outcome. like your time to detect an issue directly determines its cost.

Hope this helps.

Timely topic.

Thanks, this was very helpful. Any unwritten clause becomes a point of disagreement later as both sides remember it differently.

If you post the result here, it will help others too.

I'd appreciate it if you shared the outcome.