What your report looks like
This page is an outline of what your report contains, not a sample report. It shows the structure every engagement delivers, so you know what you are getting before we start.
What every engagement delivers
The structure below is the same whether we test a small application or a larger environment.
Cover and scope
What was tested, when, and the rules of engagement.
Executive summary
Plain-English risk picture for leadership.
Findings and evidence
Severity, description, evidence, and remediation for each issue.
Retest after fixes
Written confirmation that each finding is resolved.
Example format
This is a structure example only. The labels are generic placeholders, with no client name, no vulnerability name, and no CVSS number.
Finding: [Finding title]
Severity: [Critical / High / Medium / Low]
Description: [Plain-English summary of the issue and where it was found]
Evidence: [Steps to reproduce, with screenshots or output]
Remediation: [Step-by-step fix guidance for your developers]
Timeline
Most standard pentests wrap in 2 to 3 weeks
From kickoff to final report, a standard engagement runs about 2 to 3 weeks. We schedule testing around your development windows and support remediation throughout.
How we handle your code and access
We work under NDA on request. We ask for least-privilege, time-boxed access to your application and test accounts only. Credentials are handled securely and never stored longer than the engagement. When the engagement ends, we delete all client data and credentials. Our testing is scoped to avoid harming production systems, with no denial-of-service testing and no destructive actions.
See the full structure before you start
Book a free 30-minute call. We will walk through this outline against your application so you know exactly what your report will contain.