Penetration Test Results: Key Components and How to Evaluate Them

Your penetration test results are the documented outcome of a simulated attack on your systems: what was tested, which weaknesses a tester could exploit, how serious each one is and how to fix it. The results are the part of the test you keep.

They should serve two readers: management, who decide on risk, and the engineers who fix each issue.

Key components of pen test results

A complete set of results has five parts:

• Executive summary: The main risks, attack paths and business impact, in plain language for management. Ours comes with a technical report for IT that adds evidence and step-by-step remediation.
• Scope and methodology: What was tested, the test model, what was off limits and the frameworks used, such as the OWASP WSTG or PTES. It should match your agreed penetration test scope and rules of engagement, and show which penetration testing steps were run.
• Vulnerability findings: The issue, the conditions it needs, proof, business impact and a recommended fix, with steps to reproduce. 100% of the findings we report are manually verified.
• Severity ratings: CVSS v3.1 scores map to the qualitative ratings in the FIRST CVSS v3.1 specification: Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. Issues with no direct risk are often listed as informational.
• Remediation plan: Fixes for each finding, from patches to architecture changes, in an order that closes the riskiest issues first.

How to evaluate your results

Turn the results into fixes in three steps:

1. Address critical and high risks first: Start with remote code execution, privilege escalation and data exposure. We report critical findings during the test, so these don’t wait for the final document.
2. Look for root causes: Several findings often share one cause, such as a missing check in a shared library. In web application penetration testing and API penetration testing, one authorization gap can repeat across users, roles and tenants. Simple fixes can land during the test. Authorization, architecture or cloud permission changes need more work.
3. Verify and retest: A retest is available after fixes; whether it’s included depends on the engagement. Ours replays the original attack path, checks similar endpoints and roles for authorization issues, and marks each finding fixed, partially fixed or still present.

What our results look like, and what a test costs

You can check the format before you buy, and our prices are public:

• Format: Our sample penetration test report is a 25-page PDF for a fictional company, with findings by severity, CVSS v3.1 ratings, a remediation roadmap and retest status. No email needed.
• Delivery: In English by default, by encrypted link or file with the password sent through another channel, a few days after testing ends (see how long a penetration test takes).
• Web and API: Our standard web application or API test costs $2,500–$5,500 (typically 5–10 tester-days).
• Infrastructure and cloud: Our complex infrastructure or cloud tests cost $5,000–$12,000+ (typically 8–15 tester-days). Standalone internal penetration testing or external penetration testing is quoted individually.
• Fixed price: Our price is fixed for the agreed scope and confirmed in writing before testing. See penetration testing pricing.

Browse more pentest buyer resources, including a sample report, cost benchmarks and case studies.

Sources: FIRST, Common Vulnerability Scoring System v3.1: Specification Document; OWASP Web Security Testing Guide; Penetration Testing Execution Standard (PTES).