Pentest Report

In the first section we make clear what the reader of the pentest report can expect. It's important to clearly state which assignment we were given and which limitations were imposed. We clearly outline the scope of the research and which domains, URLs or IPs we tested. We also clearly describe the time frame in which we carried out the penetration test and the range of methods we applied at minimum.

A technical pentest report is nice, but what's the actual bottom line of the research? In the management summary we describe in detail the overall state of your organization's digital resilience. Which critical issues did we find, or not find? Where can your cybersecurity still be improved? For every issue we try to clearly describe the possible consequences, so the impact of a vulnerability is also clearly explained. At the end of the management summary we clearly show how many vulnerabilities were found, scaled by severity in line with the CVE database (Common Vulnerabilities and Exposures).

This is where we go in-depth. Even here, though, we always choose to explain the consequences of each vulnerability. So as a reader you don't need to understand the technical issue to know what happens if it isn't fixed. Vulnerabilities are always linked to CVEs (Common Vulnerabilities and Exposures), known vulnerabilities stored in a freely accessible database. During our research we're able to surface these vulnerabilities clearly. The severity of the issue comes back here too. Naturally we share how we reached our conclusion, share screenshots (proof of concept) and, where possible, offer a general remediation. This section is really for whoever will be fixing the issues.

Finally, we search various databases for "leaked credentials": any leaked data linked to your organization. This can include leaked mailing lists, passwords or other data. We share these findings so you can take action, such as blacklisting leaked passwords and their variations. Our search covers the regular web, the dark web and other databases of leaked information we've gathered over the years.

We want to prevent a pentest report from ending up in the bottom desk drawer. At Tozetta we aim to genuinely help companies move their information security forward. We try to guarantee that by debriefing the report free of charge and running a free rescan once all vulnerabilities have been fixed. The debrief removes any remaining questions about our report and the vulnerabilities found. The rescan confirms the issues have actually been resolved and that fixing them hasn't introduced new vulnerabilities.