Penetration Testing Report Writing: The Professional Guide
Here is a truth every professional learns: the report is the product. A penetration test's value lives entirely in its report — the document that turns technical findings into decisions, budgets, and fixes. Clients pay for clarity, not for clever tricks. This guide teaches the standard structure of a professional penetration testing report, how to rate severity fairly, and how to write findings that actually get fixed.
Why Reports Matter More Than Findings
A brilliant vulnerability that nobody understands is worthless. Executives decide security budgets based on the executive summary; developers fix issues based on the technical details; managers track progress based on your severity ratings. A good report speaks to all three audiences at once. It is also your legal protection: the report documents exactly what you tested, what you found, and what you recommend — within the agreed scope. Professionals are judged as much by their reports as by their technical skill.
Standard Report Structure
Most professional reports follow this structure: 1. Executive summary — a non-technical overview for decision-makers: what was tested, the overall risk level, and the top 3–5 issues in plain language. 2. Scope and methodology — what was tested, what was out of scope, the time period, and the approach used (see our methodology guide). 3. Findings — each vulnerability documented individually with severity, description, evidence, impact, and fix. 4. Recommendations — prioritized remediation steps, quick wins first. 5. Appendices — technical details, tool outputs, and retest procedures. This structure is expected by clients worldwide; learn it early.
Rating Severity Fairly
Every finding gets a severity rating — typically Critical, High, Medium, Low, or Informational. Rate by combining two factors: likelihood (how easily could this be exploited?) and impact (what happens if it is?). A login page with no rate limiting is High: easy to attack, and account takeover is serious. A verbose error message revealing a software version is Low or Informational: useful to attackers, but not directly exploitable. Many professionals reference the CVSS (Common Vulnerability Scoring System) for consistency. Be honest and consistent — inflating severity destroys your credibility, and downplaying it endangers the client.
Writing a Finding That Gets Fixed
Each finding should contain five parts: Title (clear and specific, e.g. "Stored XSS in product review field" not "Website has bug"); Description (what the issue is, in plain technical language); Evidence (proof it is real — a screenshot or request/response excerpt from your authorized test, with sensitive data redacted); Business impact (what this means for the organization — stolen customer data, defacement, downtime); and Remediation (exactly how to fix it, with references to official documentation). The remediation section is the most valuable part: a finding without a clear fix often sits unfixed for months.
Tone and Language
Write professionally and constructively. You are an advisor, not an attacker and not a judge. Say "the application does not validate input in the search field" rather than "the developers failed to..." Never include real customer data, passwords, or personal information in a report — redact everything sensitive. Avoid jargon in the executive summary; keep technical depth in the findings. And always include positive findings too: controls that worked well deserve mention, and it builds the trust that makes clients act on your recommendations.
Practice and Templates
Build a personal report template with the structure above and refine it with every lab exercise: after testing your own lab applications (see our Burp Suite guide), write up one finding in full professional format. This portfolio of sample reports — based entirely on your own lab — becomes powerful evidence of skill when applying for jobs (see our career guide). In this profession, the people who write the clearest reports get hired, get rehired, and get recommended. Technical skill opens the door; communication walks you through it.