---
title: "Contents of a Pentest Report"
description: "What's in a Pentest Report"
canonical_url: "https://docs.cobalt.io/articles/contents-of-a-pentest-report-rkAVYIfSNL"
md_url: "https://docs.cobalt.io/articles/contents-of-a-pentest-report-rkAVYIfSNL.md"
---
# Contents of a Pentest Report

## What's in a Pentest Report

Here’s what you can expect in a Pentest Report.


:::info
Our pentest reports include what you need to further secure your systems.

:::

We provide the following [types of pentest reports](https://docs.cobalt.io/en-us/articles/reports-YkC2da1roR#h-pentest-report-types):

* For [Agile](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-agile-pentest) pentests:
  * Automated Report
* For [Comprehensive](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-comprehensive-pentest) and [In-House](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-in-house-pentest) pentests:
  * Customer Letter
  * Attestation Report
  * Attestation Letter
  * Full Report
  * Full Report + Finding Details

The report type determines its contents. If you’ve purchased an appropriate [PtaaS tier](https://www.cobalt.io/pentest-pricing), you can [customize](https://docs.cobalt.io/articles/customize-your-report-uqGyfWEzaa) the contents of some reports.

Select a report section to navigate to it. Available sections depend on the report type. ![](https://docs.cobalt.io/api/attachments.redirect?id=e7ff85fd-8345-4ca5-8a7a-c635fff3f9e2)

## Target

The [Pentest Target](https://docs.cobalt.io/en-us/articles/pentest-details-LXoQDryEPD), which indicates the location of your asset.

## Test Period

The dates of the pentest engagement.

## Test Performed By

Pentesters who tested your asset. Each pentester name includes a link to their Cobalt profile.

## Executive Summary

The executive summary includes:

* A high-level summary of the tests that pentesters performed
* A table with the number of [findings](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-finding) that pentesters identified, categorized by different [severity levels](https://docs.cobalt.io/en-us/articles/severity-levels-QCUIhkAYey)
* Highlights of any significant findings

## Scope of Work

The scope shown in the following subsections varies depending on the [asset type](https://docs.cobalt.io/en-us/articles/asset-types-OQp8vLaQ85).

### Target Description

The report includes information on the asset that pentesters tested, along with the [environment](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-environment) you specified when planning the pentest:

* Production (for end users)
* Staging (proposed future production environment)
* Development (asset in work)

### In-Scope Testing Methodologies

In this section, we get into more specifics on the tests that pentesters performed. In general, we test to standards such as:

* [OWASP Top 10](https://owasp.org/Top10/)
* [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/)

In this section we include a checklist of the tests that we performed on your assets. Depending on your asset, it may also include manual and automated steps that we use with black box and grammar-based fuzzing. For more information, see:

* [OWASP definition of Fuzzing](https://owasp.org/www-community/Fuzzing)
* [A brief introduction to fuzzing and why it’s an important tool for developers](https://www.microsoft.com/en-us/research/blog/a-brief-introduction-to-fuzzing-and-why-its-an-important-tool-for-developers/)

### Test Cases that Thwarted Exploitation Attempts

This section lists the tests that did *not* find vulnerabilities while testing your asset.

## Methodology

This section includes basic methodologies that pentesters used before, during, and after the test.

### Pre-Engagement

* Scoping
* Customer
* Documentation
* Information
* Discovery

### Penetration Testing

* Tool-assisted assessment
* Manual assessment
* Exploitation
* Risk Analysis
* Reporting

### Post Engagement

* Prioritized remediation
* Best practice support
* Retesting

## Risk Factors

We use a modified version of the [OWASP Risk Rating Methodology](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), based on their business impact and likelihood. We measure each factor on a scale from 1 (very low) to 5 (very high).

## Severity Definitions

Based on the [Risk Factors](https://docs.cobalt.io/en-us/articles/customize-your-report-uqGyfWEzaa#h-risk-factors), we assign a rating to each finding, using the following equation:

```
Risk = Impact * Likelihood
```

For more information, see our documentation on [Severity Levels](https://docs.cobalt.io/en-us/articles/severity-levels-QCUIhkAYey).

## Summary of Findings

When feasible, this section includes graphs that categorize vulnerabilities by:

* Type
* Severity

### Analysis

A short summary of each vulnerability. If you have a Full Report + Finding Details, you can find more information about each vulnerability in the appendix on [Finding Details](https://docs.cobalt.io/en-us/articles/customize-your-report-uqGyfWEzaa#h-appendix-a-finding-details).

Where applicable, this section also includes a list of open ports and services.

### General Risk Profile

We include a color-coded chart based on impact and likelihood of each vulnerability.

## Recommendations

This section includes pentesters’ recommendations for what you can do to [mitigate](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-mitigate) and [remediate](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-remediate) each finding.

## Post-Test Remediation

This section includes the type, severity, and state of each finding, as well as whether the finding has been resolved.

For findings that you [Fixed](https://docs.cobalt.io/en-us/articles/customize-your-report-uqGyfWEzaa) or marked as [Accepted Risk](https://docs.cobalt.io/en-us/articles/remediate-findings-22WPR0Fnlv#h-mark-a-finding-as-accepted-risk), you can see a date when it was resolved.

## Terms

This section includes a disclaimer. Terms don’t appear in reports for [In-House Pentests](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-in-house-pentest).

## Appendix A - Finding Details

In this section, you can see details for each finding. This includes the following:

* Vulnerability Type
* Description
* Affected URLs
* Proof of Concept of the vulnerability
* Severity
* Suggested Fix