A penetration test is only useful if its findings reach the people who can fix them, with enough evidence to act and a date to act by. This report template sets out the test in the order a reviewer needs it: the executive summary, the scope, the method, the findings by severity, the remediation plan with owners, and a glossary. Each finding is tied to a risk the business can understand.

The sample reports a test of Sandpiper Cloud's customer portal, which found no critical issues, two high issues and five medium ones. The two high findings must be fixed and retested before launch. Every name, system and figure is fictional. Replace the scope, findings and owners with your own results, re-rate each one on your scale, and record the approver and the risks formally accepted.