Engagement Management · Topic 4 of 5
Report Structure and Executive Summary
Learn what a penetration test report contains, how to write the executive summary for leaders, and how report handling, delivery and retesting work.
- 5 min
- Includes a diagram
- Executive summary: short, non-technical, focused on business risk and action.
- The scope and methodology section shows what was tested, when, and how.
- Findings include enough evidence to reproduce each issue.
What it is
The report is the main product of a penetration test. It is the document that the client keeps, shares with auditors and uses to plan fixes.
A report must serve two audiences. Leaders need a short, plain summary of risk, and technical staff need enough detail to reproduce and fix each issue.
How it works
Typical sections
Formats vary, but most reports follow the same order.
| Section | Content |
|---|---|
| Executive summary | One or two pages for non-technical readers |
| Scope and objectives | What was tested, dates, limits and approach |
| Methodology | Frameworks and phases used, for example Penetration Testing Execution Standard (PTES) |
| Findings | Each vulnerability with detail and evidence |
| Attack narrative | The story of how issues chained together |
| Remediation plan | Prioritised fixes |
| Appendices | Tool output, host lists, detailed logs |
Format alignment and documentation specifications
The report should match the format the client or a standard expects. Compliance templates, the statement of work (SoW) deliverable list and audience-specific versions all shape the layout.
Documentation specifications come from the SoW and rules of engagement. They set the deliverable format, file naming, the evidence to include, timestamps, the classification label and the delivery method.
Definitions
A definitions section explains the severity scale, the likelihood and impact levels and key terms. It lets every reader interpret a score the same way.
The executive summary
The executive summary is written for managers who may read nothing else. It states the goal of the test, the overall result and the most important risks in business language.
Good summaries avoid tool names and exploit steps. They explain what could happen to the organisation, such as theft of customer records or interruption of a payment system, and what decision is needed.
A few elements help the reader.
- An overall risk statement or rating for the environment.
- The three to five most important issues, with business impact.
- A short list of recommended actions and their urgency.
- A note of positive findings, such as controls that worked.
Scope and methodology
This section proves that the work stayed inside what was agreed. It lists the dates, the in-scope assets, the test type (unknown, partially known or known environment) and any limits, such as services that were not tested.
A methodology note explains which standards guided the work, such as the National Institute of Standards and Technology (NIST) SP 800-115 or the Open Worldwide Application Security Project (OWASP) testing guidance. This makes the results repeatable and defensible.
Metrics and measures
Reports often include counts of findings by severity, the number of systems affected and measures such as how long an attack took to succeed. These help leaders compare one test with the next.
Metrics should be honest. A long list of low-risk items should not hide one critical issue.
Handling the report
The report itself is sensitive because it is a map of the client's weaknesses. It is delivered over a secure channel, labelled with a classification such as confidential, and shared only with named recipients.
The contract sets how long the tester keeps data and how it is destroyed afterwards. Draft versions are reviewed internally before release.
Using AI in reporting
Artificial intelligence (AI) tools can speed up writing, but they bring risks the report process must manage.
- Sending client data to a public AI service can leak confidential information, so check what the tool retains.
- AI can produce inaccurate or invented findings, so a person must verify every claim against the evidence.
- The client should know when AI assisted the work and approve its use, as the rules of engagement require.
After delivery
Many engagements end with a debrief meeting to walk through findings and answer questions. A retest (also called a validation test) later checks that the fixes worked, and a short attestation letter may be issued for auditors.
If an answer choice puts technical command output in the executive summary and another puts business impact there, the business impact is the correct choice.
What to remember for the exam
- Executive summary: short, non-technical, focused on business risk and action.
- The scope and methodology section shows what was tested, when, and how.
- Findings include enough evidence to reproduce each issue.
- The attack narrative shows how separate weaknesses were chained together.
- Appendices hold bulky technical material such as raw tool output.
- Reports are confidential and sent only through secure channels to approved recipients.
- Data retention and destruction follow the contract and the rules of engagement.
- A retest checks remediation after the client applies fixes.
Common mistakes
Writing one report for everyone. A single block of technical text fails executives, while a vague summary fails engineers, so each audience gets its own section.
Burying the critical issue. The summary should lead with the highest risk, not follow the order in which issues were found.
Dumping scanner output as the report. A raw export is evidence, not analysis, and belongs in an appendix at most.
Leaving out limits. If part of the scope could not be tested, the report must say so, or the client may believe that area is safe.
Forgetting positive findings. Noting controls that worked helps the client keep them and builds trust.
Check yourself
Who is the main audience of the executive summary?
Non-technical leaders who need business risk and recommended actions.
Where should bulky raw tool output go?
In the appendices.
What does a retest do?
It checks that the client's fixes actually removed the reported weaknesses.
Topic 4 of 5 in Engagement Management
Test yourself on Engagement Management
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.