What's in a Pentest Report
Our pentest reports include what you need to further secure your systems.
We provide the following types of pentest reports:
- For Agile pentests:
- Automated Report
- For Comprehensive and In-House pentests:
- Customer Letter
- Attestation Report
- Attestation Letter
- Full Report
- Full Report + Finding Details
Select a report section to navigate to it. Available sections depend on the report type.
The Pentest Target, which indicates the location of your asset.
The dates of the pentest engagement.
Test Performed By
Pentesters who tested your asset. Each pentester name includes a link to their Cobalt profile.
The executive summary includes:
- A high-level summary of the tests that pentesters performed
- A table with the number of findings that pentesters identified, categorized by different severity levels
- Highlights of any significant findings
Scope of Work
The scope shown in the following subsections varies depending on the asset type.
The report includes information on the asset that pentesters tested, along with the environment you specified when planning the pentest:
- Production (for end users)
- Staging (proposed future production environment)
- Development (asset in work)
In-Scope Testing Methodologies
In this section, we get into more specifics on the tests that pentesters performed. In general, we test to standards such as:
In this section we include a checklist of the tests that we performed on your assets. Depending on your asset, it may also include manual and automated steps that we use with black box and grammar-based fuzzing. For more information, see:
- OWASP definition of Fuzzing
- A brief introduction to fuzzing and why it’s an important tool for developers
Test Cases that Thwarted Exploitation Attempts
This section lists the tests that did not find vulnerabilities while testing your asset.
This section includes basic methodologies that pentesters used before, during, and after the test.
- Tool-assisted assessment
- Manual assessment
- Risk Analysis
- Prioritized remediation
- Best practice support
We use a modified version of the OWASP Risk Rating Methodology, based on their business impact and likelihood. We measure each factor on a scale from 1 (very low) to 5 (very high).
Based on the Risk Factors, we assign a rating to each finding, using the following equation:
Risk = Impact * Likelihood
For more information, see our documentation on Severity Levels.
Summary of Findings
When feasible, this section includes graphs that categorize vulnerabilities by:
A short summary of each vulnerability. If you have a Full Report + Finding Details, you can find more information about each vulnerability in the appendix on Finding Details.
Where applicable, this section also includes a list of open ports and services.
General Risk Profile
We include a color-coded chart based on impact and likelihood of each vulnerability.
This section includes the type, severity, and state of each finding, as well as whether the finding has been resolved.
This section includes a disclaimer. Terms don’t appear in reports for In-House Pentests.
Appendix A - Finding Details
In this section, you can see details for each finding. This includes the following:
- Vulnerability Type
- Affected URLs
- Proof of Concept of the vulnerability
- Suggested Fix