Security Strategy
What's in a Penetration Test Report? A Sample Walkthrough
The sections a real penetration test report contains, and what to actually check before accepting one.
LOZULA Senior Security Research Team
2026-08-04
7 min read
Key Takeaways for Security Teams
- A finding without reproduction steps is close to unusable for an engineering team trying to fix it.
- Severity ratings should come with reasoning, not just a color-coded label.
- Always ask whether retesting after fixes is included, a report with no verification loop leaves the real question unanswered.
A useful penetration test report goes well beyond a list of findings, it needs enough detail that your engineering team can reproduce, understand, and fix each issue without needing to re-engage the testers for clarification.
The Sections a Report Should Contain
Reports vary in style between firms, but the substance should always cover the same ground.
- •Executive summary written for non-technical stakeholders, with overall risk framed in business terms
- •Scope and methodology, stating exactly what was and was not tested
- •Detailed findings with severity ratings, reproduction steps, and evidence (screenshots, request/response pairs)
- •Remediation guidance specific to your stack, not generic advice copy-pasted across clients
What to Actually Check Before Accepting a Report
A report can look thorough on the surface while missing what actually matters.
- •Does each finding include clear, reproducible steps, or only a vague description?
- •Are severity ratings justified with reasoning, or just assigned a label with no explanation?
- •Is there a retest offered to confirm fixes actually close the finding?