What's in a Pentest Report

We provide the following types of pentest reports:

• For Agile pentests:
  • Automated Report
• For Comprehensive and In-House pentests:
  • Customer Letter
  • Attestation Report
  • Attestation Letter
  • Full Report
  • Full Report + Finding Details

The report type determines its contents. If you’ve purchased an appropriate PtaaS tier, you can customize the contents of some reports.

Select a report section to navigate to it. Available sections depend on the report type.

Target

The Pentest Target, which indicates the location of your asset.

Test Period

The dates of the pentest engagement.

Test Performed By

Pentesters who tested your asset. Each pentester name includes a link to their Cobalt profile.

Executive Summary

The executive summary includes:

• A high-level summary of the tests that pentesters performed
• A table with the number of findings that pentesters identified, categorized by different severity levels
• Highlights of any significant findings

Scope of Work

The scope shown in the following subsections varies depending on the asset type.

Target Description

The report includes information on the asset that pentesters tested, along with the environment you specified when planning the pentest:

• Production (for end users)
• Staging (proposed future production environment)
• Development (asset in work)

In-Scope Testing Methodologies

In this section, we get into more specifics on the tests that pentesters performed. In general, we test to standards such as:

• OWASP Top 10
• OWASP Application Security Verification Standard

In this section we include a checklist of the tests that we performed on your assets. Depending on your asset, it may also include manual and automated steps that we use with black box and grammar-based fuzzing. For more information, see:

• OWASP definition of Fuzzing
• A brief introduction to fuzzing and why it’s an important tool for developers

Test Cases that Thwarted Exploitation Attempts

This section lists the tests that did not find vulnerabilities while testing your asset.

Methodology

This section includes basic methodologies that pentesters used before, during, and after the test.

Pre-Engagement

• Scoping
• Customer
• Documentation
• Information
• Discovery

Penetration Testing

• Tool-assisted assessment
• Manual assessment
• Exploitation
• Risk Analysis
• Reporting

Post Engagement

• Prioritized remediation
• Best practice support
• Retesting

Risk Factors

We use a modified version of the OWASP Risk Rating Methodology, based on their business impact and likelihood. We measure each factor on a scale from 1 (very low) to 5 (very high).

Severity Definitions

Based on the Risk Factors, we assign a rating to each finding, using the following equation:

Risk = Impact * Likelihood

For more information, see our documentation on Severity Levels.

Summary of Findings

When feasible, this section includes graphs that categorize vulnerabilities by:

• Type
• Severity

Analysis

A short summary of each vulnerability. If you have a Full Report + Finding Details, you can find more information about each vulnerability in the appendix on Finding Details.

Where applicable, this section also includes a list of open ports and services.

General Risk Profile

We include a color-coded chart based on impact and likelihood of each vulnerability.

Recommendations

This section includes pentesters’ recommendations for what you can do to mitigate and remediate each finding.

Post-Test Remediation

This section includes the type, severity, and state of each finding, as well as whether the finding has been resolved.

For findings that you Fixed or marked as Accepted Risk, you can see a date when it was resolved.

Terms

This section includes a disclaimer. Terms don’t appear in reports for In-House Pentests.

Appendix A - Finding Details

In this section, you can see details for each finding. This includes the following:

• Vulnerability Type
• Description
• Affected URLs
• Proof of Concept of the vulnerability
• Severity
• Suggested Fix