CoreQ Academy1.4 Explain the components of a penetration test report.
The report is the product. It must be accurate, reproducible, readable by executives and actionable for engineers.
Report structure
- Format alignment
- Following the format the client or standard requires.
- Documentation specifications
- Required content such as evidence, timestamps and tester details.
- Risk scoring
- Consistent severity ratings (e.g. CVSS plus business context).
- Definitions
- Explaining severity levels and terms used.
- Report components
- The standard sections of a report.
- Executive summary
- One or two pages for leadership: overall risk, key findings, priorities.
- Methodology
- What was tested, how and with which frameworks and tools.
- Detailed findings
- Each issue with description, evidence, severity, affected assets and reproduction steps.
- Attack narrative
- The story of how findings were chained together to reach objectives.
- Recommendations
- Prioritised actions to reduce risk.
- Remediation guidance
- Specific technical fixes for each finding.
- Test limitations and assumptions
- What could not be tested and why, so results are not over-trusted.
Reporting considerations
- Legal
- Confidentiality, data handling and contractual obligations in the report.
- Ethical
- Accurate, unexaggerated reporting; protecting personal data found during testing.
- Quality control (QC)
- Technical and editorial review before delivery.
- Artificial intelligence (AI)
- If AI tools help write or analyse, protect client data, verify every statement and follow the client's policy on AI use.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.4 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.