Penetration tests should generate a comprehensive report that tells you everything you need to know about your company’s defenses – or lack thereof. They should summarise the threat in two ways: a lay description for those without IT training, and a technical description for those who have a deeper understanding of the threats being discussed. They should then clearly outline every vulnerability, chain those vulnerabilities together to fully contextualise the extent to which the business is exposed, and give teams the exact insights they need in order to rectify the issue(s).
But what should be hugely insightful can easily become unhelpful, overly dense or suspiciously thin, directionless and scattered without the right approach. If that’s the case, then those working within the company’s systems can operate with a false sense of security, under the assumption that the report would have clearly highlighted issues if there were any.
This is, for obvious reasons, a disaster. For that reason, here’s how to identify a penetration test that didn’t do enough to provide closure.
- Inconsistent quality
When multiple people are working on a pentest at the same time, a certain amount of coordination is needed to ensure that they’re all still on the same page, even if their attention is on other areas of the test.
In a report, a fragmented and uncoordinated team can manifest in jumbled findings, inconsistent presentation of results, and a distinct lack of clarity that will only serve to lose stakeholder interest and confuse the path forward for remediation.
One of the best solutions for pentest teams is a platform that provides clear standards and templates for testing. Frameworks should be flexible and productive, but clear, ensuring that multiple team members can work side-by-side without constant micromanagement of approach and results.
- You spent more time writing than testing
Reports need to be thorough and clear, consolidating at times scattered findings into one clear presentation of methodology, findings, and remediation recommendations. As anyone who has produced one will know, pentest report writing takes a huge amount of time – often, to the detriment of the testing phase itself, since the report is the physical deliverable.
With the right platform and template, pentest reports can become an automated step in the process, turning your findings into something tangible for clients while you focus on the technical side of the job.
- You’re missing formalised rules of engagement
Any good report will clearly outline the exact parameters in which your team was permitted to work. All too often, these rules of engagement can be overlooked entirely, or treated far too casually.
What you are authorised to do, your testing window, the scope of the pentest and what exactly you’re targeting, how you will handle data and critical findings – who you will escalate those findings to – and what techniques are off-limits to your team all need to be incontrovertibly stated within the report.
Without that, there is no clarity on the exact scope of the investigation. RoE keep testers and their clients safe.