An executive summary
The first page should be readable by someone who will never open the rest. It says what was tested, how serious the findings are overall, and the two or three things that most need attention. If your managing director can't make a decision from it, it isn't doing its job.
Scope and method
The report should state exactly what was in scope, what wasn't, when the testing happened and how it was done. This matters later: if something is breached that was never tested, you need to know that from the report, not find out afterwards.
Findings ranked by severity
Every finding should have a severity rating, so you can work through them in a sensible order. For each one you should see:
- What was found, in plain English.
- Where it was found, down to the system or address.
- Evidence, such as screenshots or request details, so your team can reproduce it.
- The risk to your business, not just a technical score.
- A specific fix, written for whoever will do the work.
Warning signs of a weak report
- It reads like scanner output. Hundreds of pages of automated results with no human judgement about what matters.
- Everything is "critical". If nothing is ranked, nothing gets prioritised.
- No evidence. Your team can't fix what they can't reproduce.
- No business context. A low-risk issue on a test server and the same issue on your payment portal are not the same problem.
- No mention of a retest. You need a way to confirm the fixes worked.
Acting on the findings
- Walk through the report with the testers, so your team understands each finding.
- Fix the critical and high findings first, then plan the rest.
- Retest once the fixes are in, and keep the updated report as evidence for customers, insurers and auditors.
- Test again after significant changes, and at least once a year.
How Zarco helps
Zarco runs every penetration test in-house: AI agents do the volume of the work and an experienced tester confirms every finding. Every report includes a leadership summary, findings ranked by severity with evidence and a specific fix, and a retest once your fixes are in.