PENETRATION TEST REPORT TEMPLATE
================================
Adapt for network, web application, internal, or external assessments.
Replace bracketed placeholders. Have legal and QA review before client use.

[Client legal name]
Assessment type: [External network / Web application / AD internal]
Report version: 1.0 (Final)
Classification: [Confidential]
Test dates: [YYYY-MM-DD] through [YYYY-MM-DD]
Lead tester: [Name, firm]

----------------------------------------------------------------------
1. EXECUTIVE SUMMARY
----------------------------------------------------------------------

Scope: Testing covered [summary] per approved scope/SoW/RoE dated [date].
Overall result: [One sentence on risk to business objectives].

Findings summary:
  Critical: [n]   High: [n]   Medium: [n]   Low: [n]   Info: [n]

Key risks (business language):
  - [Outcome 1]
  - [Outcome 2]

Strategic recommendations:
  1. [Theme: identity hardening]
  2. [Theme: patch cadence]
  3. [Theme: monitoring]

Positive observations:
  - [Control or practice that worked well]

----------------------------------------------------------------------
2. SCOPE, LIMITATIONS, AND ASSUMPTIONS
----------------------------------------------------------------------

In scope: [CIDR blocks, apps, cloud subscriptions]
Out of scope: [Payroll, third-party SaaS, production DoS]
Constraints: [Hours, no social engineering]

Limitations:
  - [e.g., credentials for admin portal not provided]
  - [e.g., two hosts unreachable during test window]

Assumptions:
  - [e.g., staging environment mirrors production configuration]

----------------------------------------------------------------------
3. METHODOLOGY
----------------------------------------------------------------------

Approach: [Gray-box external + credentialed internal]
Frameworks: [PTES, OWASP WSTG sections exercised]
CVSS version: [CVSS v4.0 / v3.1] — CVSS-B and risk rating mapping defined here
Risk rating scale: [Define Critical/High/Medium/Low mapping, e.g. 9.0-10.0 Critical]

----------------------------------------------------------------------
4. FINDINGS SUMMARY
----------------------------------------------------------------------

ID      Finding                              Severity   Status
PT-001  [Finding title]                      High       Open
PT-002  [Finding title]                      Medium     Remediated
PT-003  [Finding title]                      Low        Open

----------------------------------------------------------------------
5. TECHNICAL FINDING TEMPLATE (copy per finding)
----------------------------------------------------------------------

Finding ID:     [PT-001]
Title:          [Short, specific title]
Risk rating:    [Critical / High / Medium / Low / Informational]
CVSS-B:         [Score and full CVSS:4.0 vector string]
CWE:            [e.g., CWE-89]
Affected asset: [URL, hostname, version]

Description:
  [What is wrong and where]

Evidence:
  [Screenshot reference, request/response ID, log excerpt]

Steps to reproduce:
  1. [Step]
  2. [Step]

Impact:
  [What an attacker gains]

Remediation:
  [Specific fix and hardening]

References:
  [Vendor advisory, CWE, config guide]

Status:         [Open / Remediated / Risk Accepted / Partially Remediated]
Retest date:    [YYYY-MM-DD or N/A]
Retest result:  [Remediated / Not Remediated / Partially Remediated / Pending + brief evidence]

----------------------------------------------------------------------
6. ATTACK NARRATIVE (when applicable)
----------------------------------------------------------------------

Day 1: [Initial access step] (Finding [ID])
Day 2: [Privilege or lateral movement] (Finding [ID])
Day 3: [Objective reached] (Finding [ID])

[Omit this section when findings do not chain into a meaningful path.]

----------------------------------------------------------------------
7. REMEDIATION ROADMAP
----------------------------------------------------------------------

Example planning windows (adjust to client policy):
0-30 days:   [Immediate fixes]
30-90 days:  [Short-term controls]
90+ days:    [Long-term architecture or process]

Retest scope: [Which severities/findings will be verified]

----------------------------------------------------------------------
8. CONCLUSION AND POSITIVE OBSERVATIONS
----------------------------------------------------------------------

Overall assessment: [One paragraph on residual risk and next steps]
Strengths observed: [Controls that worked; balanced close]

----------------------------------------------------------------------
9. APPENDICES
----------------------------------------------------------------------

A. Scope asset list (from RoE)
B. Tool output (redacted)
C. Glossary