Sample
This is the pentest report your developers get.
Twenty pages, entirely fictional: client, systems, findings and every name, address and contact detail are made up. Only the structure is real — and that is exactly what you get.
What it contains
- Executive summary for the board: what was tested, what was found, how serious it is, what state it is in.
- Scope and method: application, environment, roles, period; OWASP WSTG and ASVS Level 2.
- Findings, each with severity and CVSS score, description, proof of concept to reproduce it, impact and recommendation.
- Retest: what was resolved, what was formally accepted, with a signed statement per round.
What to demand from any pentest report
If you are comparing providers, use this sample as a checklist. A useful report has, at a minimum:
- An explicit scope — which application, which environment, which roles, which period — that matches what your auditor or customer wants covered.
- A named methodology (OWASP WSTG, ASVS), not just the list of tools used.
- For every finding, a reproducible proof of concept and a CVSS score; without them, your developers have to rediscover the problem.
- A separate executive summary, written for whoever decides, not whoever fixes.
- A retest statement: what was resolved and what was formally accepted, dated and signed.
Unfiltered scanner output meets none of the five.
Who it is for
The report is written for your team: reproduce, fix, done. Your customers, investors and auditor don't get this document — they get the attestation letter (TPM).
Download the sample report (PDF, 0.4 MB)
Also available: the sample attestation letter, two pages.
FAQ
Frequently asked questions
Is the report available in Spanish?
No: in English, like all my reports and calls. That is what auditors, investors and international customers accept. If your auditor requires the evidence in Spanish, tell me in the scoping call and we'll see whether it fits.
Can I send the report to my customer or auditor?
You can, but usually you needn't and shouldn't: it contains exactly what an attacker would want to know. For customers, auditors, investors and insurers there is the attestation letter (TPM), which proves the test without handing over the findings.
A 30-minute call is enough to know whether this fits.
Book a scoping callPrefer email? Send your scope to info@hacketico.es — within 24 hours on working days you'll know whether it fits in 5 days and what it costs.