Guide · reports · checked 2026-11-08
The report is what you’re buying.
A penetration test ends in a report, and the report is what you’ll act on, hand to an auditor and show customers. A good one has six parts, below. 8 firms publish a sample you can open without a form: compare them before you compare prices.
Six sections a good report has
Executive summary
One or two pages a non-technical reader can act on: what was tested, the worst findings in business terms, and what to do first.
Scope and method
Exactly what was tested and what wasn’t, the dates, the accounts and roles used, and the method (OWASP WSTG, NIST SP 800-115, PTES).
Findings
Each with a severity (often CVSS), the affected asset, how it was found, evidence a developer can reproduce, and the business impact.
Attack paths
How individual findings chain together. This is what separates a penetration test from a scan report.
Remediation
A specific fix per finding, not a generic best practice, ideally with how to verify it.
Retest results
Which findings were confirmed fixed and when, often as a separate letter you can share with customers or auditors.
Public sample reports
| Firm | Type | Sample | Note |
|---|---|---|---|
| Decima Systems Ours | Hybrid | Open sample | Synthetic example: no live assessment was performed |
| NCC Group | Consulting firm | Open sample | |
| Synack | PTaaS platform | Open sample | |
| Bugcrowd | PTaaS platform | Open sample | |
| Astra Security | Hybrid | Open sample | |
| NetSPI | PTaaS platform | Open sample | |
| Pentera | Autonomous / AI | Open sample | |
| RunSybil | Autonomous / AI | Open sample |
Linked from each firm’s own site, checked 2026-11-08. Samples behind a form are not listed.
Questions
What should a penetration test report include?
An executive summary, the scope and method, each finding with severity, evidence and business impact, how findings chain into attack paths, specific remediation, and retest results once fixes are in.
Can I share my pentest report with customers?
Usually you share a summary or attestation letter rather than the full report, which contains exploit details. Ask the firm whether it provides one.
Is there a penetration testing report template?
Public sample reports from real firms are the best template: they show the level of detail auditors and engineers expect. The ones we found are linked on this page.
Sources for this page
- NIST SP 800-115 — Reporting as part of the standard testing methodology.
- OWASP Web Security Testing Guide: reporting — What a web application test report should contain.
- Decima Systems: sample report — Synthetic example: no live assessment was performed
- NCC Group: sample report — Public sample, no form.
- Synack: sample report — Public sample, no form.
- Bugcrowd: sample report — Public sample, no form.
- Astra Security: sample report — Public sample, no form.
- NetSPI: sample report — Public sample, no form.
- Pentera: sample report — Public sample, no form.
- RunSybil: sample report — Public sample, no form.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Penetration test reports: what a good one contains, and public samples to compare." Updated November 8, 2026. https://pentestingfirms.com/report/