Sample penetration test reports

Sample penetration test reports

These are real Cetonix reports from a full engagement, issued as redacted distribution copies against a fictional client (ACME Corporation). Section 2 of each report explains precisely what has been masked and what the client copy contains in its place — which is itself worth reading, because how a firm handles evidence tells you more than its findings do.

Each runs to roughly 50 pages: document control, redaction key, executive summary, CVSS-scored findings with reproduction steps, remediation guidance and retest status.

What happens next

1. We reply within one business day, usually with two or three scoping questions.
2. Mutual NDA signed — ours or yours — then a 30-minute scoping call at a time that suits your calendar.
3. Fixed-scope, fixed-price quote with dates on it.
4. No retainer, no sales sequence, no chasing.

Worth reading before the call

• How we handle your test data — encryption, access control, retention and destruction, and tester vetting.
• Our standard terms — including rules of engagement and governing law. We will also work under your MSA.
• Methodology — PTES, NIST SP 800-115 and the OWASP testing guides.

Questions before then? Email support@cetonix.com.