The deliverable
The report is the product. Here is what is in it.
For a testing firm the report is the thing you actually buy, and most firms will show you a contents page at best. This is the full structure of every PXLSec report, what each section is for, and what the document deliberately does not claim.
Leadership can read sections 1 to 4 and act. Engineering can work from section 5 onwards without reading anything else. That split is deliberate, and it is why the structure does not change between engagements.
| Section | Why it is there | |
|---|---|---|
| 1 | Executive summaryWhat was tested, the headline risk picture and the three things to fix first. | Written for someone who will not read any further and should not have to. No tool names, no CVE numbers, no jargon that needs a glossary — what is at risk, how bad it is, and what to do this week. If your board or your customer asks for one page, this is the page. |
| 2 | Engagement scopeTargets, assessment type, testing window, standards, exclusions and the assumptions the result depends on. | The part that determines what the report is worth. A result only means something against a stated scope, so we write down both halves: what was tested and what explicitly was not. An assurance claim without its boundary is not an assurance claim. |
| 3 | MethodologyThe five stages, what each one produces, how tooling is used and the safety rules we tested under. | Including the division of labour between automation and people: tooling maps the surface and raises candidates, a human decides what is real. Nothing is reported on the strength of a version banner or a scanner’s confidence score. |
| 4 | Severity ratingsThe scale, what each level means in practice, and how CVSS informs the rating without replacing it. | The same scale we publish openly. Where CVSS applies, a finding carries a CVSS base score and vector as well as our rating, so an assessor who works in CVSS has what they need, and where the two disagree the finding says so and explains why. |
| 5 | Summary of findingsEvery finding with its identifier, severity and current status, in remediation order. | One table. Sorted by what to do first rather than by the order we happened to find things. This is the page an engineering lead works from. |
| 6 | Detailed findingsOne section per finding: description, evidence, reproduction, impact and a specific recommendation. | The bulk of the report, and the part worth judging a firm on. Each finding carries the evidence that proves it, a reproduction path precise enough for your engineer to follow, the business impact in your context, and a fix specific enough to action — not “apply input validation”. |
| 7 | Retest and closureWhat the complimentary retest covers and exactly what the closure letter states. | Including what it deliberately does not state. A closure letter confirms that specific findings were retested and closed on a date. It is not a certificate, and it does not say your systems are secure, because no honest document could. |
| A | Appendix A — Tooling usedThe tools in the engagement, and the division of labour between automation and manual work. | Published so you can see what was run, and so a second firm could repeat the coverage if you ever wanted a comparison. |
| B | Appendix B — Out of scopeWhat was explicitly excluded, and what that means for the assurance this report provides. | The appendix most reports leave out. Exclusions are where a report quietly overstates itself, so ours are written down and their consequence is stated plainly. |
| C | Appendix C — How to read this reportWho should read which section, and how to turn it into a remediation plan. | Because a report that is never acted on was a waste of everyone’s time. |
Just as important
What the report is not
- It is not a certificateNo penetration test report certifies anything. It describes what we found, in a defined scope, during a defined window. Anyone presenting one as a guarantee of security is misrepresenting it — including us.
- It is not an audit opinionWe are a testing firm, not an auditor, assessor or certification body. We produce the testing and the evidence; your auditor or assessor decides what they accept.
- It is not a scanner export with a cover pageEvery finding was manually verified and, where it was safe, exploited to demonstrate genuine impact. Candidates that proved not to be exploitable in context are discarded rather than padded into the findings list.
- It does not pad to look thoroughIf an engagement finds little, the report says so and shows the coverage that supports the claim. A thin findings list with strong coverage is a better outcome for you than a long one full of informational noise.
Read one instead
Descriptions of a deliverable are worth less than the deliverable. The sample report is the whole 26 pages; there is also a sample AI and LLM report, 35 pages, which almost nobody in this market publishes. The severity scale and the rules of engagement behind both are published in full.
FAQ
Questions about the deliverable
Can we see a real one?
Yes. The sample report is the full 26-page deliverable, not an extract — seven findings written out in full with their evidence, reproduction steps and fixes. It is a composite built from several anonymised engagements with synthetic illustrative data, so it describes no single real client, but the structure and the depth are exactly what you would receive.
Do you tailor the structure to us?
The section structure stays the same, because consistency is what lets you compare this year's report with last year's and lets an assessor find what they need. What changes is the content and the emphasis — a report scoped against a regulatory clause foregrounds different things from one scoped against a product release.
What format do we receive it in?
A PDF, delivered over a channel agreed with you, plus a debrief with the testers who did the work. If you need findings in your tracker instead of a document, say so at scoping and we will agree the format before testing starts rather than after.
What happens after we fix things?
We retest the remediated findings and reissue the report with their status updated, plus a closure letter stating what was retested and closed. A fix we cannot verify is reported as unverified rather than quietly marked done.
Want one of these about your systems?
Tell us what you want to protect. A senior tester will help you agree the scope and next steps. We usually reply within one business day.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy