QuestionSolved

Report writing for pentests — the part nobody teaches?

Mei-Ling WuRecon

2026-06-04

I can find bugs but my reports are a mess. How do you structure a finding so a client actually acts on it?

Tomás RiveraMentorExpert✓ Accepted answer Community Favorite2026-06-06

Every finding: title, risk rating with justification, affected assets, reproduction steps a dev can follow, business impact in plain language, remediation. The business-impact line is what gets it fixed — "SQLi in /login" gets ignored; "unauthenticated attacker can dump all customer records" gets a meeting. Write impact for an exec, repro for an engineer.

Mei-Ling WuRecon2026-06-07

Splitting the audience per section (exec impact, engineer repro) is the trick. My drafts were writing both to nobody.

QuestionSolved

Report writing for pentests — the part nobody teaches?

Mei-Ling WuRecon

2026-06-04

I can find bugs but my reports are a mess. How do you structure a finding so a client actually acts on it?

Tomás RiveraMentorExpert✓ Accepted answer Community Favorite2026-06-06

Mei-Ling WuRecon2026-06-07

Splitting the audience per section (exec impact, engineer repro) is the trick. My drafts were writing both to nobody.

Report writing for pentests — the part nobody teaches?

1 answer

Report writing for pentests — the part nobody teaches?

1 answer