What is in our penetration test report
An ITovio penetration test report has two audiences. Leadership gets a short executive summary of business impact and priorities. Engineers get every finding with a proof of concept, exact reproduction steps, affected assets, CVSS severity, and a fix that addresses the root cause. A retest report then states which findings are closed.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Buyers who want to know what they are paying for before they sign.
- Customers and auditors who will read the report as evidence.
- Engineering teams who will have to act on it.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
The structure
- Executive summaryWhat was tested, what an attacker could achieve, the three to five things to fix first, in plain language for leadership and the board.
- Scope and methodTargets, dates, starting points, test accounts, exclusions and the standards followed, so a reader knows exactly what the result covers.
- Attack pathsThe chains that matter, drawn step by step from starting point to impact, with the link that breaks each chain.
- FindingsOne entry per finding: title, severity with CVSS vector, affected assets, description, business impact, proof of concept, reproduction steps and evidence.
- RemediationA specific fix for each finding, the root cause behind groups of findings, and a suggested order of work.
- What heldAreas that were attacked and resisted, with the techniques tried, so a clean area is evidence, not silence.
- RetestAfter your fixes, a short report per finding: closed, partly closed or open, with new evidence.
One finding, the way we write it
Illustrative example, not from a client report.
| Field | Content |
|---|---|
| Title | Invoices of other customers readable through the export API |
| Severity | High, with the full CVSS vector and the reasoning for it |
| Affected | The invoice export endpoint, all tenants |
| Impact | Any logged-in user of any customer can download every other customer's invoices, including names, addresses and amounts |
| Proof | Requests and responses showing a user in tenant A retrieving an invoice belonging to tenant B, with identifiers redacted |
| Reproduce | Numbered steps your developers can follow in a test environment |
| Fix | Enforce ownership on the server for every object lookup, using the session's tenant rather than any ID sent by the client; add a regression test |
| Root cause | Authorisation is checked per route, not per object; the same pattern was found in two other endpoints |
Asked before most engagements
Can we share the report with customers?
How quickly do we get critical findings?
Is the retest included?
Reviewed by the ITovio security team on 3 November 2026.
Related
How to scope a penetration test
Read itGuidePenetration test vs vulnerability scan: the real difference
Read itServiceWeb application penetration testing
Read itServiceAPI penetration testing for REST and GraphQL
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Network and Active Directory, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
