LearnTrack
Reporting
Reporting turns what a test found into changes an engineer can make. It is not a list of the tools that ran, and a finding that cannot be reproduced from the report alone is not finished.
1 page
What am I looking at
- I have a confirmed finding to write up Report How to write a pentest finding
- I have a severity the client disputes Report How to write a pentest finding
- I have a fix to retest Report How to write a pentest finding
Kill chain
-
Recon
Not yet written.
-
Access
Not yet written.
-
Escalation
Not yet written.
-
Persistence
Not yet written.
-
Impact
Not yet written.
-
Report
- How to write a pentest finding A finding is only worth what gets fixed because of it. The reader who matters is not the security lead who commissioned the test, but the engineer who picks up the ticket three weeks later, was not on any call, and has to decide in ten minutes whether the finding is real and what to change.