How to Read a Penetration Test Report (With Examples)

What a penetration test report contains

A penetration test report contains a structured account of what was tested, what was found, how serious each issue is and how to fix it. A professional report is not a raw scanner export, and it serves a board or compliance reader and an engineer at the same time.

Learning how to read a pen test report starts with knowing what a credible one should hold. The board or compliance reader needs the risk summary, while the engineer needs the detail to reproduce and remediate every finding.

Most UK reports follow a consistent shape: an executive summary, a scope and methodology section, a findings overview with a severity breakdown, detailed individual findings, and appendices listing the tools, in-scope assets and any exclusions. If a report jumps straight to a wall of automated alerts with no narrative, no scope statement and no remediation guidance, that is a sign the work was a vulnerability scan dressed up as a penetration test. You can see how the two differ across our wider security testing services.

The report should also name the standards it worked to, such as the OWASP Testing Guide or the Penetration Testing Execution Standard. That reference tells you the findings are mapped to a recognised methodology rather than an in-house checklist, which makes them defensible to auditors.

Start with the executive summary

The executive summary is written for decision-makers, so it is the right place to begin even if you are technical. It should state, in plain English, the overall risk posture of the tested environment and whether the organisation is exposed to anything that needs urgent attention. Read it for trends, not just totals: five medium findings that all point to the same weak patching process are a different problem from five unrelated mediums, and the narrative should connect those dots into a short, prioritised set of actions. If the summary simply repeats the findings count without interpreting it, the report is making you do the analysis the tester should have done.

How to read severity ratings and CVSS scores

Most UK reports use a five-band severity scale: critical, high, medium, low and informational. These bands are usually derived from CVSS, the Common Vulnerability Scoring System, which scores a vulnerability from 0.0 to 10.0, where 9.0 and above is critical, 7.0 to 8.9 is high and 4.0 to 6.9 is medium.

The most important thing to understand when reading severity is that the score is not the same as your risk. CVSS measures a vulnerability in isolation. It does not know that the affected server holds your entire customer database, or that it sits behind three other controls and is unreachable from the internet. A good tester adjusts the rating to reflect real exploitability and business impact in your environment, and a good report explains why. So read each finding’s severity alongside two questions: how reachable is the affected asset, and what would an attacker gain by exploiting it?

For example, a high-severity SQL injection finding might read: “CVSS 8.6 (High). An unauthenticated attacker can extract the full user table, including hashed passwords, by injecting into the login form.” That one sentence tells you the score, the access required, the impact and the proof, which is how every issue should read.

Anatomy of a single finding

Once you reach the detailed findings, each one should follow the same repeatable structure so you can scan it quickly. Knowing this anatomy is the core skill in how to read a pen test report.

Title and severity. A clear, specific name for the issue, such as “Broken object-level authorisation on the orders API”, plus its severity band and CVSS score.

Affected assets. The exact hosts, URLs, endpoints or parameters where the issue exists, so your team knows precisely where to look.

Description and impact. What the weakness is and what an attacker could achieve with it, expressed in terms of your data and business, not generic textbook wording.

Proof of concept. The evidence that the tester actually exploited or confirmed the issue, typically a request and response, a screenshot or a sanitised data sample. This is the line between a real penetration test and a speculative scanner alert: a finding with no reproduction steps cannot be trusted or fixed with confidence.

Remediation and references. Specific, actionable fix guidance, ideally with links to CWE entries, OWASP guidance or vendor advisories. “Apply input validation” is weak; “use parameterised queries for all database calls on this endpoint” is useful and verifiable.

Scope, methodology and what was not tested

A finding only means something in the context of what was actually examined, so the scope and methodology section deserves close reading. It should list the in-scope assets, the testing perspective, the dates of testing and the constraints the testers worked under. Crucially, it should also state what was excluded. An out-of-scope system is not a clean system; it is an untested one, and treating exclusions as a pass is a common mistake.

Check the testing type as well. A grey-box web test with valid credentials surfaces authorisation flaws that a black-box test never reaches, so their absence in a black-box report does not mean they are absent from your application. If the scope feels narrower than your real attack surface, raise it before accepting the report as a clean bill of health.

Turning the report into an action plan

A report is only valuable if it changes what your team does next. Work through the findings in severity order, fixing critical and high issues first, but use the description and impact fields to sense-check that ordering against your own context. Assign an owner and a target date to each finding, and track them through your normal change process.

Pay attention to recurring root causes. If several findings trace back to missing input validation, an unpatched component or a flawed authorisation model, fixing the underlying pattern resolves multiple issues at once. For UK organisations with compliance obligations, this remediation evidence is what auditors expect to see: a finding, a fix and a confirmation. If you hold or are pursuing ISO 27001 or Cyber Essentials Plus, the report and its remediation trail feed directly into your technical vulnerability management evidence.

Finally, look for a retest. A report without a follow-up only proves you had problems on the day of testing, whereas a retest that confirms your fixes work and closes each finding is what demonstrates the risk was reduced. Cost is driven by the scope of the original test, and you can see how tester days map to price on our penetration testing cost page.

How EJN Labs approaches reporting

EJN Labs is a CREST-accredited UK penetration testing firm, and we also hold Cyber Essentials, Cyber Essentials Plus, ISO 27001 and ISO 9001. Every report is produced by the senior and principal testers who carried out the work, so the findings, evidence and remediation advice come from the people who actually performed the assessment. We rate findings by real-world risk in your environment, not by raw CVSS alone, and each one includes reproduction steps and proof so your developers can verify and fix it without guesswork.

Our reports lead with a plain-English executive summary for your board and follow with technical detail mapped to recognised standards such as OWASP. Pricing is fixed and agreed before we start, scoped to your environment rather than padded with junior days, and every engagement includes a free retest. You can review the full range of assessments on our security testing services page.

Frequently Asked Questions

What is the most important section of a pen test report?

The findings section is the most important part of a pen test report, because that is where the real value sits, but the executive summary is the right place to start reading since it tells you the overall risk posture and which issues need urgent attention.

Read the summary for context, then work through each finding’s severity, evidence and remediation to build your action plan in priority order.

Does a high CVSS score always mean high risk to my business?

No, a high CVSS score does not always mean high business risk. CVSS measures a vulnerability’s technical characteristics in isolation, not its impact in your specific environment, so the same score can represent very different levels of real-world exposure for your organisation.

A high score on an internal, well-protected system may carry less real risk than a medium issue on an internet-facing asset holding customer data, so read the score alongside the affected assets and impact.

How should I prioritise the findings in a report?

Work in severity order, addressing critical and high findings first, but sense-check that ordering against your own context using the impact and affected-assets fields. Assign an owner and a target date to each issue, and look for recurring root causes across the findings.

Spotting a shared root cause lets you fix an underlying pattern once rather than patching the same flaw repeatedly.

What does proof of concept mean in a pen test report?

Proof of concept means the evidence that a tester actually confirmed or exploited an issue, usually a request and response, a screenshot or a sanitised data sample. It is the line between a manual penetration test and an automated scanner alert.

A finding with clear reproduction steps can be trusted and fixed with confidence, while one with no evidence cannot.

Should a pen test report include a retest?

Yes. A report without a follow-up only proves issues existed on the day of testing. A retest confirms your fixes work and formally closes each finding, which is what demonstrates the risk was actually reduced. Reputable providers, including EJN Labs, include a free retest as standard.

Get a fixed-price penetration test and a report you can act on

If you want an assessment that produces a clear, prioritised report rather than a raw scanner dump, our CREST-certified testers will scope the work to your environment and give you a fixed price before anything starts. Request a CREST penetration testing quote, or explore our full security testing services.