How to Evaluate a Penetration Testing Report

A good finding is reproducible#

Look for affected URLs or components, permissions needed, clear steps, relevant requests or screenshots, impact and recommended changes. A scanner flag without validation is not the same as an exploitability assessment.

Severity needs context#

Scores and labels help prioritize, but business exposure, sensitivity, preconditions and attack chaining matter. Prioritization should not rely on a CVSS number alone.

Understand the limitations#

No test covers everything. The report should identify access constraints, excluded assets, test accounts, time boundaries and areas that could not be verified.

Recommendations should target the control#

“Validate input” or “apply authentication” is rarely enough. For authorization issues, for example, remediation should enforce object and tenant access on the server.

Closure needs evidence#

A developer comment saying “fixed” is not the same as retesting. Ask for verification results and any residual risk.