How to read a penetration test report
Turn a pentest report from a wall of red into a prioritized plan, without a security background. A section-by-section guide.
You've paid for a penetration test and a PDF just landed in your inbox. Here's how to turn it from a wall of red into a prioritized plan, without a security background.
A penetration test report can look intimidating: severity ratings, CVSS vectors, reproduction steps, acronyms. But a good report is written to be used, not admired. If you know what each part is for, you can read one in fifteen minutes and walk away knowing exactly what to fix first. Here's the map.
Start at the executive summary, then stop and think
The executive summary is the whole report in miniature. It should tell you three things in plain language: the overall risk rating, how many findings there are by severity, and the two or three things leadership should care about. If you read nothing else, read this. A well-written summary lets a CTO or a board member understand the risk without decoding a single CVSS vector.
What to look for: an overall risk rating (usually Critical/High/Medium/Low), a severity breakdown (how many of each), and key recommendations. If the summary is just "we found some issues, see below," that's a quality red flag: the report isn't doing its most important job.
Understand severity, and why it's contextual
Every finding has a severity: Critical, High, Medium, Low, or Informational. This is your triage order. Critical and High findings are the ones an attacker could realistically exploit for serious impact, so fix those first.
Most reports back severity with a CVSS score (0 to 10) and a "vector string" like AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. You don't need to memorize it, but here's the gist: it encodes how the vulnerability is attacked (network vs. local), how hard it is, whether the attacker needs privileges or user interaction, and the impact on confidentiality, integrity, and availability. A good tester also contextualizes the score to your business. A data-exposure bug matters more for a financial platform than a marketing site, and the report should say so.
Read a finding like a story
Each finding should answer four questions:
- What is it? A clear description of the vulnerability.
- How do you know it's real? Reproduction steps and evidence. This is the difference between a real pentest and a scanner dump: every serious finding should be reproducible, not a "potential" flagged by a tool.
- Why does it matter? The business impact, in terms you can act on.
- How do you fix it? Concrete, specific remediation, not "apply best practices."
If a finding has all four, you can hand it straight to an engineer. If it's missing the fix or the proof, push back on your vendor.
The remediation roadmap is where the value is
The best part of a report isn't the findings. It's the prioritized remediation roadmap: what to fix, in what order, who owns it, and roughly how much effort each takes. This turns a list of problems into a plan. Look for a table that sequences the work by priority, not just by severity.
Don't skip the retest
A finding isn't closed because you shipped a fix. It's closed because someone verified the fix works. A quality engagement includes a retest: the tester re-checks each remediated finding and confirms it's actually gone. The report should show retest status per finding. (At Cybros, retest is included at no extra cost. A fix you can't prove is just a hope.)
A quick checklist for reading any report
- Does the executive summary make sense to a non-technical leader?
- Is every finding reproducible, with evidence?
- Does each finding have a concrete fix, not just a warning?
- Is there a prioritized remediation roadmap?
- Is there a retest, or a plan for one?
Key takeaways
- The executive summary and remediation roadmap are the two most valuable sections. Start and finish there.
- Severity is your triage order; CVSS explains why, contextualized to your business.
- Every real finding is reproducible and comes with a specific fix.
- No retest, no proof the risk is closed.
Want to see what a good report actually looks like? Download our free sample penetration test report. It's a full, illustrative report you can use to benchmark any vendor.