Pentest Report Example: A Complete Sample Report With Findings You Can Copy

The Structure of a Professional Pentest Report

Before we dive into the example, here is the structure we will follow. Most professional reports include these sections in this order:

• Cover Page
• Document Control
• Executive Summary
• Scope and Methodology
• Risk Assessment Summary
• Detailed Findings
• Remediation Roadmap
• Appendices

This structure works for web application assessments, internal network tests, external assessments, and most other engagement types. If you are writing a web app report specifically, our web application pentest report guide covers the nuances.

Cover Page Example

The cover page is your first impression. Keep it clean and professional.

Content to include:

• Report title (e.g., "Penetration Testing Report")
• Client name (Apex Financial Services)
• Engagement type (External Penetration Test)
• Testing dates (February 10 - February 21, 2026)
• Report date (February 25, 2026)
• Classification level (Confidential)
• Your company name and logo
• Version number (v1.0)

Do not overcomplicate this. A single page with the information above is all you need. No decorative graphics, no filler text.

Document Control Example

This section tracks report versions and distribution. It is short but important for audit trails.

Version History:

Distribution List:

Classification: This document is classified as Confidential. Distribution is limited to the individuals listed above. Do not share this report outside the organization without written approval from Apex Financial Services.

Executive Summary Example

The executive summary is the most-read section of your entire report. Many stakeholders will read nothing else, so it needs to stand on its own. Write it for a non-technical audience.

Notice what this example does well. It states the engagement scope upfront, gives a severity breakdown, highlights the most dangerous findings in business terms, and ends with a clear recommendation. It avoids technical jargon.

For more tips on this section, see our complete pentest report writing guide.

Scope and Methodology Example

This section documents exactly what was tested, how it was tested, and what was excluded. It protects both you and the client.

Risk Assessment Summary Example

Give stakeholders a quick visual overview before the detailed findings. A summary table and severity breakdown work well here.

Findings by Severity:

Findings by Category:

Map your findings to OWASP Top 10 categories when possible. It helps clients understand patterns and compliance teams map issues to frameworks.

Detailed Finding Examples

This is the core of your report. Each finding should be a self-contained block that anyone can read independently. Below are two example findings - one critical and one medium.

POST /api/auth/login HTTP/1.1
Host: portal.apexfinancial.com
Content-Type: application/json

{
  "username": "admin' OR '1'='1' --",
  "password": "anything"
}

sqlmap -u "https://portal.apexfinancial.com/api/auth/login" \
  --data='{"username":"*","password":"test"}' \
  --dbs --level=3

// Vulnerable
const query = `SELECT * FROM users WHERE username = '${username}'`;

// Fixed
const query = 'SELECT * FROM users WHERE username = $1';
const result = await pool.query(query, [username]);

HTTP/1.1 200 OK
Server: nginx/1.24.0
Content-Type: text/html; charset=UTF-8
Strict-Transport-Security: max-age=31536000

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

If you are not sure how the CVSS scores above were calculated, our CVSS scoring guide breaks down each metric.

Remediation Roadmap Example

Do not just dump findings and walk away. Give the client a prioritized action plan organized by urgency and effort.

Quick Wins: Findings 4 (password policy) and 6 (security headers) can be remediated in under two hours with configuration changes only. We recommend addressing these immediately alongside the critical items.

Appendices Example

Include supporting information that is useful but would clutter the main report.

Appendix A - Tool Output. Full Nmap scan results, Burp Suite crawl maps, and automated scanner output. Reference these from individual findings where relevant.

Appendix B - CVSS Scoring Methodology. Brief explanation of CVSS 3.1 base metrics and how severity ratings map to scores. Link to our CVSS 3.1 scoring guide if the client wants more detail.

Appendix C - Testing Credentials. Document any accounts provided by the client. Confirm whether credentials were rotated or disabled after testing.

Appendix D - Glossary. Define technical terms used in the report. This is especially useful when the report is shared with non-technical stakeholders.

Common Mistakes in Pentest Reports

After reviewing hundreds of pentest reports, these are the mistakes we see most often:

Vague titles. "XSS Found" tells the reader nothing. Be specific about where and what impact.

Missing evidence. A finding without a screenshot or request/response pair is just an opinion. Always prove it.

No CVSS vector. Writing "High" without a CVSS score is subjective and clients will push back. Our CVSS scoring guide makes this easy.

Copy-paste remediation. Telling every client to "implement input validation" without context is lazy. Show them the exact fix for their tech stack.

No executive summary. Developers read findings. Executives read the summary. Skip it and your report loses half its audience.

No remediation roadmap. Findings without a prioritized plan leave clients overwhelmed. Tell them what to fix first.

Speed Up Your Report Writing

Writing a professional report like the example above can take 4 to 8 hours manually. That is time you could spend testing. PentestReportAI takes your raw findings, tool output, and screenshots, then generates a publication-ready report in minutes. You get CVSS 3.1 auto-scoring, five professional templates, and PDF/DOCX export. Every report follows the exact structure we covered in this guide.

Download the Full Example

Want this entire example as a downloadable template? Grab our free pentest report templates in DOCX and PDF format. We have templates for general assessments, web applications, network pentests, mobile testing, internal assessments, and enterprise engagements.